The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'u…
CVSS 3.1HIGH 8.8·Network·Low privileges·No interaction·EPSS 0.0056·Published 2024-01-08·Fixed in 1.2.9CWE-502