A vulnerability was found in pricing-table-by-supsystic Plugin up to 1.8.1 on WordPress (WordPress Plugin). It has been declared as critical. Affected by this vulnerability is an unknown part of the component Permission Check. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, createFromTpl, and getJSONExportTable endpoints, unauthenticated users can retrieve pricing table information, create new tables, or import/modify a table.

The weakness was released 03/23/2020. This vulnerability is known as CVE-2020-9392 since 02/25/2020. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.8.2 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-161324, VDB-161793, VDB-161796 and VDB-162076.

Productinfo

Type

• WordPress Plugin

Name

• pricing-table-by-supsystic Plugin

Version

• 1.8.0
• 1.8.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion