CVE-2019-25151: Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation
The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activateplugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25151?
CVE-2019-25151 has a medium severity rating as it allows authenticated attackers to activate any plugin on the WordPress site.
How do I fix CVE-2019-25151?
To fix CVE-2019-25151, update the Funnel Builder plugin for WordPress to version 1.3.1 or later.
Who is affected by CVE-2019-25151?
Anyone using Funnel Builder plugin for WordPress versions up to and including 1.3.0 is affected by CVE-2019-25151.
What is the potential impact of CVE-2019-25151?
The potential impact of CVE-2019-25151 includes unauthorized activation of plugins, leading to further attacks or compromise of the WordPress site.
Is authentication required to exploit CVE-2019-25151?
Yes, exploitation of CVE-2019-25151 requires authentication to the WordPress site.