App For Cloudflare
Monthly
Authenticated attackers holding a Subscriber-level account or higher can exploit a missing authorization check in the WordPress plugin App for Cloudflare (versions 1.10.1 and earlier) to modify plugin settings without proper permissions. The vulnerability has a CVSS score of 6.5, requires low-privilege credentials on a site where the plugin is active, and results in unauthorized configuration changes with no confidentiality or availability impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; sites that allow user self-registration or that have existing low-privilege accounts are most at risk.
Authenticated attackers holding a Subscriber-level account or higher can exploit a missing authorization check in the WordPress plugin App for Cloudflare (versions 1.10.1 and earlier) to modify plugin settings without proper permissions. The vulnerability has a CVSS score of 6.5, requires low-privilege credentials on a site where the plugin is active, and results in unauthorized configuration changes with no confidentiality or availability impact. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; sites that allow user self-registration or that have existing low-privilege accounts are most at risk.