title: Shortcut Macros <= 1.3 - Subscriber+ Arbitrary Settings Update
description: The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: Shortcut Macros
vendor: Unknown
versions:
lessThanOrEqual: 1.3, status: affected, version: 1.3, versionType: custom
}