Mediavine Control Panel
Monthly
Broken Access Control in the Mediavine Control Panel WordPress plugin (versions <= 2.10.10) permits Contributor-level authenticated users to invoke restricted plugin functionality that should require higher privileges, resulting in unauthorized integrity impacts. Rooted in CWE-862 (Missing Authorization), the plugin fails to enforce WordPress capability checks before executing sensitive actions via network-accessible endpoints. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Broken Access Control in the Mediavine Control Panel WordPress plugin (versions <= 2.10.10) permits Contributor-level authenticated users to invoke restricted plugin functionality that should require higher privileges, resulting in unauthorized integrity impacts. Rooted in CWE-862 (Missing Authorization), the plugin fails to enforce WordPress capability checks before executing sensitive actions via network-accessible endpoints. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.