Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.9, 2.3, 1.5, 1.6, 2.7, and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.
Timeline
- CVE published
- Record last updated
Affected versions
- CatchThemes Essential Widgets
From 1.9 · fixed in 1.9
- CatchThemes To Top
From 2.3 · fixed in 2.3
- CatchThemes Header Enhancement
From 1.5 · fixed in 1.5
- CatchThemes Generate Child Theme
From 1.6 · fixed in 1.6
- CatchThemes Essential Content Types
From 1.9 · fixed in 1.9
- CatchThemes Catch Web Tools
From 2.7 · fixed in 2.7
- CatchThemes Catch Under Construction
From 1.4 · fixed in 1.4
- CatchThemes Catch Themes Demo Import
From 1.6 · fixed in 1.6
- CatchThemes Catch Sticky Menu
From 1.7 · fixed in 1.7
- CatchThemes Catch Scroll Progress Bar
From 1.6 · fixed in 1.6
- CatchThemes Social Gallery and Widget
From 2.3 · fixed in 2.3
- CatchThemes Catch Infinite Scroll
From 1.9 · fixed in 1.9
- CatchThemes Catch Import Export
From 1.9 · fixed in 1.9
- CatchThemes Catch Gallery
From 1.7 · fixed in 1.7
- CatchThemes Catch Duplicate Switcher
From 1.6 · fixed in 1.6
- CatchThemes Catch Breadcrumb
From 1.7 · fixed in 1.7
- CatchThemes Catch IDs
From 2.4 · fixed in 2.4