CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).
Explanation of Vulnerability in Simple Terms
WPML Multilingual CMS versions up to 4.5.10 contain an access control weakness that allows authenticated users with low privileges to modify site content and disrupt availability. The vulnerability does not require user interaction and affects the plugin's core functionality. Site administrators should update to a version newer than 4.5.10.
What an attacker can do
Modify site content and cause temporary unavailability of the site.
Potential impact on your site
Unauthorized users can alter published content and temporarily disrupt site operations.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., contributor or subscriber).
Key dates
External resources
Related vulnerabilities
