Description
The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd_action function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to change or reset plugin settings. CVE-2023-36509 appears to be a duplicate of this issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sureshchand12a CHP Ads Block Detector
Default version status: unaffected
0 to ≤ 3.9.4affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4eca64d7-6e33-4b8e-af37-a3e8bbf2b76f?source=cve ↗
- https://plugins.trac.wordpress.org/changeset/2920522/chp-ads-block-detector ↗
- https://plugins.trac.wordpress.org/changeset/2922313/chp-ads-block-detector ↗
- https://plugins.trac.wordpress.org/changeset/2926660/chp-ads-block-detector ↗