Vulnerability feed

Executive summary

A broken access control flaw in the WPMobile.App WordPress plugin, made by Amauri.IO, lets users reach actions they should not be allowed to perform. The advisory rates it high priority with a CVSS score of 7.5 and says it is expected to be exploited. The recommended fix is to update the plugin to version 11.87 or later.

Technical summary

This is a Broken Access Control issue (OWASP A1) in the WPMobile.App WordPress plugin, and the advisory states it requires no privileges (unauthenticated). Versions 11.86 and earlier are affected and version 11.87 is the patched release. The advisory states that Patchstack has issued a mitigation rule that blocks attacks until the site is updated, and that Patchstack users can enable auto-update for vulnerable plugins. The advisory does not state the specific endpoint or function involved, any workaround other than updating and the mitigation rule, or any indicators of compromise or detection guidance. Whether exploitation has been observed in the wild is not stated beyond the advisory's expectation that it will be exploited.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affects

Amauri.IOAmauri.IO WPMobile.App

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

None

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

Amauri.IOAmauri.IO WPMobile.App