Back to CVE List

CVE-2019-25763

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score
9.8 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Description

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and authenticate as that user.

Vulnerability Details

Published Date
Last Modified
CWE ID
CWE-288
Source
NVD
Vendor
Ultimatebeaver
Product
Ultimate Addons for Beaver Builder

External References

Discussion (0)

Add Comment

No comments yet. Be the first!