Ibtana Ecommerce Product Addons
Monthly
Authenticated attackers holding only Subscriber-level access on a WordPress site running the Ibtana - Ecommerce Product Addons plugin (all versions up to and including 0.4.7.7) can update or delete arbitrary post meta entries by invoking the 'iepa_use_gt_editor' AJAX action, which performs no capability check. The impact is limited to integrity - post meta content can be altered or removed, but there is no confidentiality or availability loss, which is why the issue scores 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) despite the vendor's PR:N vector; Subscriber authentication is a hard prerequisite. There is no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation requires a valid low-privilege account (trivial on sites with open registration, otherwise an existing user) and the vulnerable plugin version.
Authenticated attackers holding only Subscriber-level access on a WordPress site running the Ibtana - Ecommerce Product Addons plugin (all versions up to and including 0.4.7.7) can update or delete arbitrary post meta entries by invoking the 'iepa_use_gt_editor' AJAX action, which performs no capability check. The impact is limited to integrity - post meta content can be altered or removed, but there is no confidentiality or availability loss, which is why the issue scores 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) despite the vendor's PR:N vector; Subscriber authentication is a hard prerequisite. There is no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation requires a valid low-privilege account (trivial on sites with open registration, otherwise an existing user) and the vulnerable plugin version.