CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Noah Hearle, Design Extreme Reviews and Rating – Google My Business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reviews and Rating – Google My Business: from n/a through 4.14.
Explanation of Vulnerability in Simple Terms
The Reviews and Rating – Google My Business plugin for WordPress versions up to 4.14 lacks proper authorization checks on certain administrative functions. An attacker can trick a site visitor into performing unintended actions by visiting a malicious link, potentially modifying plugin settings or data. Update to a version newer than 4.14 to resolve this issue.
What an attacker can do
Trick a visitor into modifying plugin settings or data without authorization.
Potential impact on your site
Plugin settings or stored review data could be altered by attackers exploiting visitor clicks.
Conditions required to exploit
Attacker must craft a malicious link and the victim must visit it while logged into the site.
Key dates
External resources
Related vulnerabilities
