xwp vulnerabilities and threats

The Stream plugin for WordPress up to version 4.2.0 contains an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to access all activity records via the Heartbeat API without proper authorization checks. The vulnerability is identified as CWE-862 and has a medium severity rating with a CVSS score of 6.5.

The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated attackers to update arbitrary options that can lead to DoS or privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.