First published: Thu Sep 05 2024(Updated: )
The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and ajax__geolocate_remove_menu functions in all versions up to, and including, 8.6.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete WordPress menus.
Credit: security@wordfence.com
Affected Software | Affected Version | How to fix |
---|---|---|
Infinitumform Geo Controller Wordpress | <=8.6.9 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.