Description
The ApplyOnline – Application Form Builder and Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the aol_modal_box AJAX action in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with subscriber access or higher, to view Application submissions.
References (4)
Core 4
Scores
CVSS v3
4.3
EPSS
0.0037
EPSS Percentile
28.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-862
Status
published
Products (2)
farhannoor/ApplyOnline – Application Form Builder and Manager
< 2.6
farhannoor/ApplyOnline – Application Form Builder and Manager
< 2.6.2
Published
May 22, 2024
Tracked Since
Feb 18, 2026