Starter Templates
Monthly
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'http_request_host_is_external' filter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates - Elementor, WordPress & Beaver Builder Templates.2.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'http_request_host_is_external' filter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates - Elementor, WordPress & Beaver Builder Templates.2.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.