BaseFortify

Executive Summary

The Streamit WordPress plugin before version 1.3.10 has a vulnerability where an unauthenticated AJAX route lacks authorization and nonce verification. This allows attackers to call arbitrary PHP functions with attacker-supplied arguments, enabling actions like creating an administrator account or executing remote code.

Useful 0 Not Useful 0

Detection Guidance

Check if the Streamit WordPress plugin version is below 1.3.10 by inspecting the plugin files or WordPress admin panel. Look for unauthorized AJAX route calls in server logs or network traffic.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to gain full control of a WordPress site by creating admin accounts or executing malicious code. It can lead to complete site compromise, data theft, or further attacks from the compromised site.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Streamit plugin to version 1.3.10 or higher immediately. If updating is not possible, consider disabling the plugin until an update is applied.

Useful 0 Not Useful 0