Vulnerability Description
The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_del_st_submit() function in functions.php only require knowing the student id number.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Saadamin | Simple Student Result | <= 1.6.3 |
Related Weaknesses (CWE)
References
- https://limbenjamin.com/articles/simple-student-result-auth-bypass.htmlExploitThird Party Advisory
- https://wordpress.org/plugins/simple-student-result/#developersRelease NotesThird Party Advisory
- https://wpvulndb.com/vulnerabilities/8920ExploitThird Party Advisory
- https://limbenjamin.com/articles/simple-student-result-auth-bypass.htmlExploitThird Party Advisory
- https://wordpress.org/plugins/simple-student-result/#developersRelease NotesThird Party Advisory
- https://wpvulndb.com/vulnerabilities/8920ExploitThird Party Advisory
FAQ
What is CVE-2017-14766?
CVE-2017-14766 is a vulnerability with a CVSS score of 7.5 (HIGH). The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_del_st_submit() function in functions.php ...
How severe is CVE-2017-14766?
CVE-2017-14766 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-14766?
Check the references section above for vendor advisories and patch information. Affected products include: Saadamin Simple Student Result.