CVE-2024-5770
WP Force SSL & HTTPS SSL Redirect <= 1.66 - Missing Authorization to Settings Update
mediumMissing Authorization
4.2
CVSS Score
4.2
CVSS Score
medium
Severity
1.67
Patched in
1d
Time to patch
Description
The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:LAttack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
None
Confidentiality
Low
Integrity
Low
Availability
Technical Details
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.