CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14.
Explanation of Vulnerability in Simple Terms
The WordPress Social Login and Register plugin through version 7.5.14 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can perform actions they should not be permitted to do by visiting a specially crafted page. The plugin does not validate user permissions before executing sensitive operations, allowing privilege escalation within the plugin's scope.
What an attacker can do
A low-privilege logged-in user can perform unauthorized administrative actions within the plugin.
Potential impact on your site
Unauthorized users could modify plugin settings or perform actions reserved for administrators, potentially compromising site configuration.
Conditions required to exploit
Attacker must have a WordPress user account (low privilege level) and the victim must visit a malicious link or page.
Key dates
External resources
Related vulnerabilities
