CVE-2019-15771 – ND Shortcodes <= 5.9.1 - Unauthenticated WordPress Options Update

https://notcve.org/view.php?id=CVE-2019-15771

The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. El plugin nd-shortcodes versiones anteriores a 6.0 para WordPress, presenta una acción nopriv_ AJAX que permite la modificación de la configuración de siteurl The ND Shortcodes plugin for WordPress is vulnerable to arbitrary options update in versions up to, and including 5.9.1, due to missing capability checks and insufficient validation of the options supplied. This makes it possible for unauthenticated attackers to update arbitrary site options that can allow them to escalate their privileges to that of an administrator which can lead to a full site takeover. • https://threatpost.com/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn/147671 https://wordpress.org/plugins/nd-shortcodes/#developers https://wpvulndb.com/vulnerabilities/9485 • CWE-269: Improper Privilege Management CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •