CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.
Explanation of Vulnerability in Simple Terms
The Accordions plugin for WordPress versions up to 2.0.3 contains an authorization flaw that allows high-privilege users to read sensitive data, modify site content, or disrupt service. The vulnerability requires an authenticated admin or editor account to exploit. Site owners should update immediately to a version newer than 2.0.3.
What an attacker can do
Read sensitive data, modify content, or disrupt the site if they have admin or editor access.
Potential impact on your site
Compromised admin or editor accounts can access confidential information and alter site functionality.
Conditions required to exploit
Attacker must have high-level WordPress user privileges (admin or editor role).
Key dates
External resources
Related vulnerabilities
