CVE-2017-1002006
HighSummary
Vulnerability in WordPress plugin DTracker version 1.5 allows adding new contacts to the wp_contact table without checking user authorization.
Risk Assessment
Lack of authorization when adding contacts may lead to unauthorized access and manipulation of data, posing a serious security threat to the application.
Recommendation
It is recommended to update the DTracker plugin to the latest version that implements proper authorization mechanisms.
Other vulnerabilities in WordPress plugin DTracker v1.5
See all- CVE-2017-1002007High
Vulnerability in WordPress plugin DTracker v1.5 allows injecting new contacts into the wp_contact table without checking user authorization.
- CVE-2017-1002005High
Vulnerability in WordPress plugin DTracker v1.5 is due to lack of input sanitization in the ./dtracker/delete.php file. The contact_id variable is not properly filtered before being appended to an SQL query.
- CVE-2017-1002004High
Vulnerability in WordPress plugin DTracker v1.5 is due to the lack of user input sanitization in the ./dtracker/download.php file. The id variable is appended to the SQL query without proper processing.
Original NVD description (English source)
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.