Hello Plus
Monthly
Authorization bypass in the Hello Plus plugin for WordPress (all versions up to and including 1.7.7) allows authenticated users holding Contributor-level privileges or higher to publish their own Hello+ header/footer templates and to draft active templates belonging to higher-privileged users. The plugin's template-parts actions do not verify that the caller is authorized to publish or modify those documents, so the flaw is an integrity and availability problem rather than a data-disclosure one. Exploitation requires a valid low-privileged WordPress account, making multi-author sites and sites that allow Contributor-level self-registration the primary exposure; no public exploit code has been identified at time of analysis and there is no indication of active exploitation.
Authorization bypass in the Hello Plus plugin for WordPress (all versions up to and including 1.7.7) allows authenticated users holding Contributor-level privileges or higher to publish their own Hello+ header/footer templates and to draft active templates belonging to higher-privileged users. The plugin's template-parts actions do not verify that the caller is authorized to publish or modify those documents, so the flaw is an integrity and availability problem rather than a data-disclosure one. Exploitation requires a valid low-privileged WordPress account, making multi-author sites and sites that allow Contributor-level self-registration the primary exposure; no public exploit code has been identified at time of analysis and there is no indication of active exploitation.