Ezoic Integration

Ezoic is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 2.22.11.

Ezoic from 2.6.35 before 2.23.1 leaves Ezoic_Content_Export::check_headers() effectively disabled. An unauthenticated POST to /wp-json/ezoic-cms/v1/export/initiate reaches initiate_export_event(), run_or_schedule_export() and export(), which exports database tables and packages and uploads the archive; the advisory states that password hashes and password-reset tokens are included. Other content routes also use unrestricted permission callbacks, and X-Ezoic-CMS and X-Emote request headers can persistently change plugin settings. The archive retrieval destination and required Ezoic account-link state are not disclosed.

Ezoic Integration is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ezoic Integration is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.