Botiga Pro
Monthly
Unauthenticated remote attackers can abuse a missing authorization check in a REST route of the Botiga Pro WordPress plugin (versions before 1.6.5) to update arbitrary WordPress options, inject stored web scripts that execute on every front-end page, and move arbitrary posts to the trash. The option-write primitive enables privilege escalation and full site takeover, for example by altering registration or default-role settings, while the stored script injection yields persistent cross-site scripting against all site visitors. The issue is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and no CISA KEV listing has been observed; the only deployment prerequisite is that the Pro add-on plugin is installed and active, as the free Botiga theme alone is unaffected.
Unauthenticated remote attackers can abuse a missing authorization check in a REST route of the Botiga Pro WordPress plugin (versions before 1.6.5) to update arbitrary WordPress options, inject stored web scripts that execute on every front-end page, and move arbitrary posts to the trash. The option-write primitive enables privilege escalation and full site takeover, for example by altering registration or default-role settings, while the stored script injection yields persistent cross-site scripting against all site visitors. The issue is rated CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and no CISA KEV listing has been observed; the only deployment prerequisite is that the Pro add-on plugin is installed and active, as the free Botiga theme alone is unaffected.