miniOrange's Google Authenticator <= 5.5.82 - Missing Authorization

miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on an the mo_wpns_malware_redirect function in versions up to, and including, 5.5.82. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to initiate/terminate malware scans or obtain the malware scan status of a currently ongoing or the last scan. Terminating ongoing scans could aid an attacker who is attempting to infect a site, while repeatedly initiating new scans could lead to resource exhaustion. Additionally, knowing the status of the last scan might help an attacker who wishes to further compromise a site or server.

• www.wordfence.com