Description
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Infility Global | < 2.16.25 | 2.16.25 |
References
- https://wpscan.com/vulnerability/2d730144-fc13-4921-aa2f-1e0233b0a196/ exploit vdb-entry technical-description