Executive Summary

This vulnerability exists in the Webcake – Landing Page Builder plugin for WordPress, where a missing capability check on the 'webcake_save_config' AJAX endpoint allows authenticated users with Subscriber-level access or higher to modify the plugin's settings without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

An attacker with at least Subscriber-level access can modify the plugin's settings, potentially leading to unauthorized changes in the website's landing page configurations, which could affect site behavior or security.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Webcake – Landing Page Builder plugin to version 1.2 or later, as the vulnerability affects all versions up to and including 1.1. Additionally, restrict Subscriber-level access if possible and monitor plugin settings for unauthorized changes. [2]

Useful 0 Not Useful 0