TinyMCE Color Picker <= 1.1 is vulnerable to Security Bypass

Unauthenticated

Published
2014-05-21

The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information.

CVE

https://www.cve.org/CVERecord?id=CVE-2014-3844

CVSS

Score:5.3

Severity:Medium

Version: 1.1

There is a patch available in v1.2 and we strongly recommend you update to this version as soon as possible.