CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
What the vulnerability does
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.
Explanation of Vulnerability in Simple Terms
WordPress versions 5.8 beta 1 contain an information exposure vulnerability affecting the wordpress-develop product. An authenticated attacker with low privileges can read sensitive data and modify site content through a network-based attack that does not require user interaction. The vulnerability stems from improper access controls on certain operations.
What an attacker can do
Read sensitive data and modify site content without higher-level permissions.
Potential impact on your site
Low-privilege users (subscribers, contributors) can access and alter data they should not be able to reach.
Conditions required to exploit
Attacker must have a low-privilege WordPress account; network access to the site.
Key dates
External resources
Related vulnerabilities
