Easy Integration For Dropbox
Monthly
Unauthenticated arbitrary file access in the Easy Integration for Dropbox WordPress plugin before 2.2.0 lets remote attackers list, download, and upload files across the site's connected Dropbox account and harvest the connected-account and administrator email addresses. Several file-management AJAX actions are registered for logged-out users but skip authorization checks (CWE-862), turning the plugin into an open proxy to the linked cloud storage. Publicly available exploit code exists and a vendor patch is released, though EPSS estimates exploitation probability at only 0.14% (4th percentile).
Unauthenticated arbitrary file access in the Easy Integration for Dropbox WordPress plugin before 2.2.0 lets remote attackers list, download, and upload files across the site's connected Dropbox account and harvest the connected-account and administrator email addresses. Several file-management AJAX actions are registered for logged-out users but skip authorization checks (CWE-862), turning the plugin into an open proxy to the linked cloud storage. Publicly available exploit code exists and a vendor patch is released, though EPSS estimates exploitation probability at only 0.14% (4th percentile).