Openstation Admin Dashboard Notes Custom Dashboard Ai Assistant Pwa
Monthly
Authorization bypass in the OpenStation WordPress plugin (slug desktop-mode) through version 1.1.16 lets any authenticated user at subscriber level or above modify other users' placement rows - position, sort order, parent folder and meta - and read serialized metadata such as title, permalink and post status for the entities those placements reference. The attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the 'read' capability that every default WordPress role holds, and the chain additionally depends on at least one orphaned placement existing, a state the plugin's own trash cascade produces when it marks a parent folder trashed while leaving child placements' parent_id intact. Rated medium (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) with low confidentiality and integrity impact; no public exploit identified at time of analysis, and the priority signal places it in this_month rather than emergency handling.
Authorization bypass in the OpenStation WordPress plugin (slug desktop-mode) through version 1.1.16 lets any authenticated user at subscriber level or above modify other users' placement rows - position, sort order, parent folder and meta - and read serialized metadata such as title, permalink and post status for the entities those placements reference. The attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the 'read' capability that every default WordPress role holds, and the chain additionally depends on at least one orphaned placement existing, a state the plugin's own trash cascade produces when it marks a parent folder trashed while leaving child placements' parent_id intact. Rated medium (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) with low confidentiality and integrity impact; no public exploit identified at time of analysis, and the priority signal places it in this_month rather than emergency handling.