CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters input. This means that unauthenticated attackers can bypass the length restrictions and input more characters than allowed via the settings.
Explanation of Vulnerability in Simple Terms
Demon Image Annotation versions 5.0 and earlier contain a vulnerability that allows an attacker to modify data or disrupt service without authentication. The flaw stems from insufficient input validation or access controls. No confidentiality impact is present, but integrity and availability of the annotation system can be compromised. Update to a version newer than 5.0 when available.
What an attacker can do
Modify annotation data or cause the service to become unavailable without needing to log in.
Potential impact on your site
Attackers can corrupt image annotations or disrupt the annotation service for all users.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
