Subscriber Settings Change in WP-Stateless <= 4.4.1

Executive Summary

This vulnerability in WP-Stateless plugin versions 4.4.1 and earlier allows attackers with low-level privileges, such as subscribers, to change plugin settings. It is classified as a Broken Access Control issue under OWASP Top 10 and has a high CVSS severity score of 8.1.

Useful 0 Not Useful 0

Detection Guidance

Check if the WP-Stateless plugin version is 4.4.1 or earlier. Use WordPress admin dashboard or run a command like 'wp plugin list' in the WordPress directory to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to manipulate plugin settings, potentially leading to unauthorized changes in how the plugin functions. This may affect website behavior, data handling, or security configurations. Mass-exploit campaigns targeting thousands of websites are expected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers with low-level privileges to manipulate plugin settings, which could lead to unauthorized data access or modification. Such unauthorized changes may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by exposing sensitive information or altering configurations without proper authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP-Stateless plugin to version 4.4.2 immediately. If updating is not possible, apply the mitigation rule provided by Patchstack to block attacks until the update is completed.

Useful 0 Not Useful 0