Broken Access Control vulnerability

Resolved jimk1416
(@jimk1416)

8 months, 2 weeks ago

It is being reported that this plugin has a security issue. When can we expect a fix?

WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.8 – Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mika (Patchstack Alliance) in WordPress Plugin WP Accessibility Helper (WAH) (versions <= 0.6.2.8)
Date: 09.07.2024 | Source: https://patchstack.com/database/vulnerability/wp-accessibility-helper/wordpress-wp-accessibility-helper-wah-plugin-0-6-2-8-broken-access-control-vulnerability?_a_id=110

Viewing 12 replies - 1 through 12 (of 12 total)

Plugin Author Alex Volkov
(@vol4ikman)

8 months, 2 weeks ago

Hello, thank you for the report.

It will be fixed within 5-6 days. Thanks

Thread Starter jimk1416
(@jimk1416)

8 months, 2 weeks ago

hey @vol4ikman

Thank you for your quick response.

Plugin Author Alex Volkov
(@vol4ikman)

8 months, 2 weeks ago

Hi there,

The new 0.6.2.9 version released

Thread Starter jimk1416
(@jimk1416)

8 months, 2 weeks ago

Thanks for the follow up.

Ate Up With Motor
(@ate-up-with-motor)

8 months, 1 week ago

You might need to inform Patchstack that it’s been patched: They’re still flagging it (even though they specify the issue as version 0.6.2.8 and below) and listing it as “no fix has been released.”

Plugin Author Alex Volkov
(@vol4ikman)

8 months, 1 week ago

I am on it

Thanks

Thread Starter jimk1416
(@jimk1416)

8 months, 1 week ago

Hey @vol4ikman

Looks like Wordfence is now reporting another vulnerability

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-accessibility-helper/wp-accessibility-helper-wah-0629-missing-authorization

Plugin Author Alex Volkov
(@vol4ikman)

8 months, 1 week ago

It’s the same one
I am working on it with patchstack team

Thread Starter jimk1416
(@jimk1416)

8 months, 1 week ago

Gotcha. Thanks again.

Plugin Author Alex Volkov
(@vol4ikman)

8 months, 1 week ago

Please update up to 0.6.3 version

Thread Starter jimk1416
(@jimk1416)

8 months, 1 week ago

Thanks again for keeping this plugin secure.

Plugin Author Alex Volkov
(@vol4ikman)

8 months, 1 week ago

Issue resolved

Viewing 12 replies - 1 through 12 (of 12 total)

The topic ‘Broken Access Control vulnerability’ is closed to new replies.