CVE-2019-25151
First published: Wed Jun 07 2023(Updated: )
The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Krzysztof Kozlowski Konwert | <1.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.nintechnet.com/privilege-escalation-vulnerability-fixed-in-wordpress-cartflows-plugin/
- https://wpscan.com/vulnerability/b6725319-909f-4d5c-9b34-8b6ea627b223%5D
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-funnel-builder-by-cartflows-create-high-converting-sales-funnels-for-wordpress-privilege-escalation-1-3-0/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b95670-0767-4325-88d0-4ae6d7302558?source=cve
Frequently Asked Questions
What is the severity of CVE-2019-25151?
CVE-2019-25151 has a medium severity rating as it allows authenticated attackers to activate any plugin on the WordPress site.
How do I fix CVE-2019-25151?
To fix CVE-2019-25151, update the Funnel Builder plugin for WordPress to version 1.3.1 or later.
Who is affected by CVE-2019-25151?
Anyone using Funnel Builder plugin for WordPress versions up to and including 1.3.0 is affected by CVE-2019-25151.
What is the potential impact of CVE-2019-25151?
The potential impact of CVE-2019-25151 includes unauthorized activation of plugins, leading to further attacks or compromise of the WordPress site.
Is authentication required to exploit CVE-2019-25151?
Yes, exploitation of CVE-2019-25151 requires authentication to the WordPress site.
- agent/references
- agent/type
- agent/severity
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cartflows
- canonical/krzysztof kozlowski konwert