Unauthenticated User Account Creation in 爱采集数据采集和发布插件 WordPress Plugin

Executive Summary

This vulnerability affects the WordPress plugin Icollect version 1.0.0 or below. It allows unauthenticated users to create WordPress user accounts and taxonomy terms because the plugin does not restrict which handler methods can be invoked via requests. No capability or nonce checks are performed, enabling unauthorized actions.

Useful 0 Not Useful 0

Detection Guidance

Check if the 爱采集数据采集和发布插件 WordPress plugin version 1.0.0 or below is installed. Look for unauthorized user accounts or taxonomy terms created without authentication.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to create unauthorized user accounts or taxonomy terms on your WordPress site without authentication. This could lead to unauthorized access, data manipulation, or further attacks on your site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized user account creation and taxonomy term modifications, potentially violating data integrity and access control requirements in GDPR and HIPAA. Unrestricted method dispatch and lack of capability checks may enable unauthorized data access or modification, compromising compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Remove or disable the 爱采集数据采集和发布插件 WordPress plugin immediately. Monitor for suspicious user account or taxonomy term creation until a patch is available.

Useful 0 Not Useful 0