Headline
CVE-2023-37890: WordPress KB Support – WordPress Help Desk plugin <= 1.5.88 - Missing Authorization vulnerability - Patchstack
Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88.
Solution
Update to fix
vPatch available
Update the WordPress KB Support plugin to the latest available version (at least 1.5.89).
Found this useful? Thank Rafshanzani Suhada for reporting this vulnerability. Buy a coffee ☕
Rafshanzani Suhada discovered and reported this Broken Access Control vulnerability in WordPress KB Support Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 1.5.89.
Other vulnerabilities in this plugin
0 present
3 patched
View all
WordPress plugin developer?
Start a free security program for your WordPress plugins or request an audit.
Apply for MVDP
Security researcher?
Report to Patchstack Alliance bounty platform and earn monthly cash prizes.
Learn more