This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: A critical security hole in the **GRÜN spendino Spendenformular** WordPress plugin.…
🛡️ **Root Cause**: **CWE-862** (Missing Authorization). The plugin fails to verify if the user has the right permissions before allowing data updates. 🚫 No capability check exists.
Q3Who is affected? (Versions/Components)
👥 **Affected**: **GRÜN Software Group GmbH**. 📦 **Product**: GRÜN spendino Spendenformular. 📅 **Version**: **1.0.1 and earlier** versions are vulnerable.
Q4What can hackers do? (Privileges/Data)
💀 **Attacker Actions**: Unauthenticated users can update **arbitrary WordPress options**. 🎯 **Goal**: Change default registration role to **Administrator** and enable user registration for full site takeover.
Q5Is exploitation threshold high? (Auth/Config)
⚡ **Threshold**: **LOW**. 🌐 **Access**: No authentication required (PR:N). 🖱️ **Interaction**: No user interface interaction needed (UI:N). Easy to exploit remotely.
Q6Is there a public Exp? (PoC/Wild Exploitation)
🔓 **Exploit**: **YES**. Public PoC available on GitHub (RandomRobbieBF). 🌍 **Status**: Wild exploitation is possible due to low complexity and no auth requirement.
Q7How to self-check? (Features/Scanning)
🔍 **Self-Check**: Scan for **GRÜN spendino Spendenformular** plugin. 📋 **Version Check**: Verify if version is **≤ 1.0.1**. 🧪 **Test**: Attempt unauthenticated API calls to update options (use PoC script).
Q8Is it fixed officially? (Patch/Mitigation)
🩹 **Fix**: Update the plugin to a version **newer than 1.0.1**. 🏢 **Vendor**: GRÜN Software Group GmbH should release a patched version with proper capability checks.
Q9What if no patch? (Workaround)
🚧 **Workaround**: If no patch exists, **disable the plugin** immediately. 🛑 **Block Access**: Restrict access to WordPress admin endpoints or use WAF rules to block unauthorized option updates.
Q10Is it urgent? (Priority Suggestion)
🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **P1**. CVSS Score is **High** (9.8 implied by H/I/H). Immediate action required to prevent site compromise.