Pricing Table Wordpress Plugin
Monthly
An insecure direct object reference (CWE-639) in the Pricing Table WordPress plugin before 4.1.3 lets users with the contributor role or higher duplicate legacy pricing tables without any authorization check, thereby cloning and publishing arbitrary posts and pages on the site - including private and draft content owned by other users. Publicly available exploit code exists, and exploitation requires only a legitimate low-privilege account plus use of the plugin's legacy duplication feature; impact is confined to content cloning/publication rather than full site takeover, which keeps this at moderate severity.
An insecure direct object reference (CWE-639) in the Pricing Table WordPress plugin before 4.1.3 lets users with the contributor role or higher duplicate legacy pricing tables without any authorization check, thereby cloning and publishing arbitrary posts and pages on the site - including private and draft content owned by other users. Publicly available exploit code exists, and exploitation requires only a legitimate low-privilege account plus use of the plugin's legacy duplication feature; impact is confined to content cloning/publication rather than full site takeover, which keeps this at moderate severity.