Droip
Monthly
Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber-level privileges to manipulate content and settings via droip_post_apis() AJAX handler. Exploitable actions include arbitrary post deletion/creation, post duplication, settings modification, and user account manipulation. Requires only low-privilege authenticated access (PR:L) for high-impact compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis.
Arbitrary file upload in Themeum Droip WordPress plugin (versions up to 2.5.1) permits authenticated attackers with Subscriber-level privileges or higher to upload malicious files without file type validation in the make_google_font_offline() function, enabling remote code execution on the affected server. CVSS 8.8 severity reflects low privilege requirement (PR:L) and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Unauthenticated path traversal in Themeum's Droip WordPress plugin (versions prior to 2.5.2) lets remote attackers read sensitive files outside the intended directory and trigger availability impact with scope change to the underlying WordPress host. CVSS rates this 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H), and while no public exploit is identified at time of analysis, the EPSS of 1.13% (78th percentile) signals meaningfully elevated exploitation interest relative to the broader CVE population.
Missing Authorization vulnerability in Themeum Droip droip allows Exploiting Incorrectly Configured Access Control Security Levels.5.2. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber-level privileges to manipulate content and settings via droip_post_apis() AJAX handler. Exploitable actions include arbitrary post deletion/creation, post duplication, settings modification, and user account manipulation. Requires only low-privilege authenticated access (PR:L) for high-impact compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis.
Arbitrary file upload in Themeum Droip WordPress plugin (versions up to 2.5.1) permits authenticated attackers with Subscriber-level privileges or higher to upload malicious files without file type validation in the make_google_font_offline() function, enabling remote code execution on the affected server. CVSS 8.8 severity reflects low privilege requirement (PR:L) and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Unauthenticated path traversal in Themeum's Droip WordPress plugin (versions prior to 2.5.2) lets remote attackers read sensitive files outside the intended directory and trigger availability impact with scope change to the underlying WordPress host. CVSS rates this 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H), and while no public exploit is identified at time of analysis, the EPSS of 1.13% (78th percentile) signals meaningfully elevated exploitation interest relative to the broader CVE population.
Missing Authorization vulnerability in Themeum Droip droip allows Exploiting Incorrectly Configured Access Control Security Levels.5.2. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.