Description
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Construction Light | < 1.6.8 | 1.6.8 |
References
- https://wpscan.com/vulnerability/cfabf8b2-30a4-462f-996c-79888a439c09/ exploit vdb-entry technical-description