CyberRota Analysis
AI-GeneratedThe Layouts for WPBakery plugin for WordPress is vulnerable due to a lack of capability checks in the `template_sync()` callback, allowing unauthenticated attackers to send arbitrary outbound HTTP requests to the plugin's external API. This vulnerability enables attackers to write the API's JSON responses directly into the site's `wp_options` table without any verification or rate limiting, potentially compromising site integrity. WordPress site administrators using this plugin should prioritize applying updates or implementing mitigations to safeguard against potential exploitation.
Original NVD Description
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync()` callback registered via `wp_ajax_nopriv_handle_sync` in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (`https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}`) and to write the JSON-decoded responses verbatim into the site's `wp_options` table via `set_transient()` — at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.