Description
The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permission_callback() function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create, update or delete any user meta, including flipping their own wp_capabilities to administrator and fully escalate their privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
offsprout Offsprout Page Builder
Default version status: unaffected
2.2.1 to ≤ 2.15.2affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9269d18d-8d83-43ff-b777-ba8f58321e9e?source=cve ↗
- https://wordpress.org/plugins/offsprout-page-builder/#developers ↗
- https://plugins.trac.wordpress.org/browser/offsprout-page-builder/tags/2.15.2/api/class-offsprout-api-extensions.php#L5 ↗
- https://plugins.trac.wordpress.org/browser/offsprout-page-builder/tags/2.15.2/api/class-offsprout-api-extensions.php#L514 ↗