CVE-2019-16251 – YIT Plugin Framework <= 3.3.8 - Authenticated Settings Change

https://notcve.org/view.php?id=CVE-2019-16251

31 Oct 2019 — plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. el archivo plugin-fw/lib/yit-plugin-panel-wc.php en YIT Plugin Framework versiones hasta 3.3.8 para WordPress, permite cambios de opciones autenticados. Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function i... • https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework • CWE-862: Missing Authorization •