CVE-2018-11579: Medium severity multidots woocommerce category banner management vulnerability
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wpajaxnopriv usage. Anyone can change the plugin's setting by simply sending a request with a wbmsaveshoppagebannerdata action.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-11579?
CVE-2018-11579 is a vulnerability in the MULTIDOTS WooCommerce Category Banner Management plugin for WordPress that allows unauthenticated users to change the plugin's settings.
How does CVE-2018-11579 affect the MULTIDOTS WooCommerce Category Banner Management plugin?
CVE-2018-11579 allows anyone to change the plugin's settings by sending a request with a specific parameter.
What is the severity of CVE-2018-11579?
CVE-2018-11579 has a severity rating of medium with a CVSS score of 5.3.
How can I fix CVE-2018-11579?
To fix CVE-2018-11579, update the MULTIDOTS WooCommerce Category Banner Management plugin to version 1.1.1 or later.
Where can I find more information about CVE-2018-11579?
You can find more information about CVE-2018-11579 at the following sources: [http://labs.threatpress.com/unauthenticated-settings-change-vulnerability-in-woocommerce-category-banner-management-plugin/](http://labs.threatpress.com/unauthenticated-settings-change-vulnerability-in-woocommerce-category-banner-management-plugin/) and [https://wordpress.org/plugins/banner-management-for-woocommerce/#developers](https://wordpress.org/plugins/banner-management-for-woocommerce/#developers)