CVE-2019-25738

WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change

CVSS 9.3 CRITICALEPSS 0.3%CWE-306

WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

framework-y · Hybrid Composer

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/47154unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://labs.sucuri.net/wptf-hybrid-composer-unauthenticated-arbitrary-options-update/https://www.exploit-db.com/exploits/47154 https://www.vulncheck.com/advisories/wordpress-hybrid-composer-unauthenticated-settings-change http://wordpress.framework-y.com http://wordpress.framework-y.com/hybrid-composer/