CVE-2017-14766 Student Result or Employee Database <= 1.6.3 - Authentication Bypass
HighCVSS 7.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_del_st_submit() function in functions.php only require knowing the student id number.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| saadamin simple student result | <= 1.6.3 | No fix listed |
| wordpress simple-student-result(WordPress) | < 1.6.4 | 1.6.4 |
References
- limbenjamin.com exploit third-party-advisory
- wordpress.org release-notes third-party-advisory
- wpvulndb.com exploit third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org