CVE-2023-0889 | BDVDB-2026-200280 Detail

Description#

Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12023-04-17Record published in the CVE List.
2. Version 22025-02-06Most recent update recorded in the CVE List.