OMGF 5.6.0 through 5.7.9 saves its settings form on admin_init without a working capability and nonce check, so unauthenticated visitors can change the plugin’s settings, which allows stored cross-site scripting and the deletion of directories through the cache-cleanup routine. The patch requires the manage_options capability and a valid settings nonce, and skips cache directories whose path does not resolve to itself.
This vulnerability affects the following application versions:
- OMGF 5.6.0
- OMGF 5.6.1
- OMGF 5.6.2
- OMGF 5.6.3
- OMGF 5.6.4
- OMGF 5.6.5
- OMGF 5.6.6
- OMGF 5.6.7
- OMGF 5.7.0
- OMGF 5.7.1
- OMGF 5.7.2
- OMGF 5.7.4
- OMGF 5.7.5
- OMGF 5.7.6
- OMGF 5.7.7
- OMGF 5.7.8
- OMGF 5.7.9