Significant Vulnerability Discovered in Website Builder by SeedProd: Recommendations and Analysis

The identified vulnerability is called "missing capability check" in the 'seedprod_lite_new_lpage' function. Capabilities are specific actions that users or roles are allowed to perform. Capability checking is an important security mechanism in WordPress for managing permissions and access control. They determine whether a user has the right to perform a specific action.

"The lack of capability validation allows unauthorized attackers to potentially modify the content of various pages created by the plugin, such as the 'coming soon' or 'under maintenance' pages. The lack of this protection mechanism exposes websites to the risk of data integrity violations."

🚀 Unauthorized data modification is a serious security issue. It occurs due to a defect where unauthorized persons can modify data, leading to potential exploits. Remediation of this vulnerability in the Website Builder plugin is highly recommended.

• 📌 The vulnerability is rated 8.2 out of 10 on the scale, with a severity classification of "high" by the Common Vulnerability Scoring System (CVSS). A high score indicates a serious potential impact.
• 📌 This vulnerability is so new that there is currently no entry in the National Vulnerability Database for the assigned number CVE-2024-1072.
• 📌 However, Wordfence's WordPress security researchers highlighted the severity of SeedProd's Website Builder vulnerability: "It allows an unauthorized attacker to modify the content of the coming soon, maintenance, login, and 404 pages configured with the plugin."

🚀 The publisher of Website Builder by SeedProd has responded by releasing an updated version, 6.15.22, that addresses this vulnerability. The update includes a secure nonce to reduce the risk, and users of the plugin are strongly advised to update immediately to protect their website from attacks.

"A Nonce is a 'one-time number' that helps protect URLs and forms from certain types of abuse, malicious or otherwise... They help protect against several types of attacks..."