Security vulnerability in WordPress Slick Popup Plugin

[djbaxter]

Privilege Escalation Flaw Present In Slick Popup Plugin
Wordfence.com
May 28, 2019

A privilege escalation vulnerability in the Slick Popup plugin, currently active on 7000 websites, has been reported. The flaw allows attackers with Subscriber-level access to create Administrator-level accounts, effectively taking over the site. We contacted the developers with the details on April 22nd and a fix has not yet been released.

Read more...

 

[djbaxter]

Clarification from Wordfence:

At this time, all version of Slick Popup up to 1.7.1 are vulnerable.

Slick Popup still has not released a fix.