Cyr To Lat Reloaded Transliteration Of Links And File Names
Monthly
Broken access control in Cyr to Lat Reloaded (WordPress plugin by Themeisle) allows low-privileged authenticated users at the subscriber role to invoke restricted plugin actions on affected WordPress installations running version 1.3.3 and below. The flaw stems from missing authorization checks (CWE-862), permitting subscribers to perform operations intended for higher-privileged users such as editors or administrators. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility via standard WordPress HTTP endpoints make it straightforward to abuse given subscriber-level access.
Broken access control in Cyr to Lat Reloaded (WordPress plugin by Themeisle) allows low-privileged authenticated users at the subscriber role to invoke restricted plugin actions on affected WordPress installations running version 1.3.3 and below. The flaw stems from missing authorization checks (CWE-862), permitting subscribers to perform operations intended for higher-privileged users such as editors or administrators. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility via standard WordPress HTTP endpoints make it straightforward to abuse given subscriber-level access.