Cool Media Filter WordPress plugin privilege escalation
Anyone who signs up on a site with this add-on can become its admin.
Summary
The Cool Media Filter WordPress plugin does not check permissions when changing a role's capabilities, so any logged-in user, such as a subscriber, can grant themselves administrator rights. Version 1.0.1 and older are affected.
Affected when
- Cool Media Filter plugin installed (1.0.1 and older)
- attacker holds any logged-in account, such as subscriber
What to do
No fixed version is known yet. Check that the installed plugin is newer than 1.0.1 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
Times
First published
First seen