CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Inqsys Technology Duplicate Post Page Menu & Custom Post Type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Duplicate Post Page Menu & Custom Post Type: from n/a through 2.4.1.
Explanation of Vulnerability in Simple Terms
The Duplicate Post Page Menu & Custom Post Type plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify or delete content they should not have access to. The vulnerability affects versions up to 2.4.1. An attacker with a basic user account can bypass permission checks to alter site data. Update to a version newer than 2.4.1 to resolve this issue.
What an attacker can do
Modify or delete posts and pages without proper permission checks.
Potential impact on your site
Unauthorized users can alter or remove published content, potentially disrupting site integrity and user trust.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., Contributor or Subscriber).
Key dates
External resources
Related vulnerabilities
