Loading HuntDB...

Allow authenticated users can edit, trash,and add new in BuddyPress Emails function

Medium
W
WordPress
Submitted None
Reported by hoangkien1020

Vulnerability Details

Technical details and impact analysis

Privilege Escalation
## Description: Allow author can edit, trash,and add new your posts in BuddyPress Emails function And editor can edit,trash, add new any posts in BuddyPress Emails default. ## Steps To Reproduce: Step 1 : Create two accounts: Admin and Author Step 2: Login with admin account. In admin account, give author to admin account. Step 4: Login with author within dashboard Access link: *domain/wp-admin/edit.php?post_type=bp-email* Step 5: Revoke author to author privilege in admin account Step 6: Within author dashboard, author can edit, trash,and add new PoC by video: https://bit.ly/2UH7iLz ## Recommendations Valid user current session access. ## Impact Author can edit, trash,and add new in BuddyPress Emails. And editor can edit,trash, add new any posts in BuddyPress Emails default.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Privilege Escalation