Subscriber Broken Access Control in Link Whisper Premium

Executive Summary

The vulnerability is a Broken Access Control issue in the WordPress Link Whisper Premium Plugin, versions 2.9.0 and below.

It allows unprivileged users, such as those with a Subscriber role, to perform actions that normally require higher privileges because of missing authorization, authentication, or nonce token checks.

This means that users who should have limited access can exploit this flaw to gain unauthorized capabilities within the plugin.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized actions being performed by low-privileged users, potentially compromising the integrity of your website.

Since it allows privilege escalation, attackers could exploit it in large-scale campaigns targeting thousands of websites.

The impact is considered moderately dangerous with a CVSS score of 6.5, indicating a significant risk if left unpatched.

Immediate action, such as updating the plugin to version 2.9.1 or later, is advised to mitigate this risk.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability allows unprivileged users, such as those with a Subscriber role, to perform actions requiring higher privileges due to missing authorization, authentication, or nonce token checks.

Detection involves monitoring for unauthorized privilege escalation attempts or suspicious activity from Subscriber accounts within the WordPress Link Whisper Premium plugin version 2.9.0 or below.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation includes updating the Link Whisper Premium plugin to version 2.9.1 or later.

Until the update is applied, Patchstack has provided a mitigation rule to block attacks exploiting this vulnerability.

Taking these steps will prevent unprivileged users from exploiting the broken access control issue.

Useful 0 Not Useful 0