WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change
Vulnerability Description
WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-25738
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- yasin
References
- https://www.exploit-db.com/exploits/47154
- http://wordpress.framework-y.com
- http://wordpress.framework-y.com/hybrid-composer/
- https://labs.sucuri.net/wptf-hybrid-composer-unauthenticated-arbitrary-options-update/
- https://www.vulncheck.com/advisories/wordpress-hybrid-composer-unauthenticated-settings-change
Affected Vendor
framework-y
View all reports →