CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Portfolio and Projects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio and Projects: from n/a through 1.3.7.
Explanation of Vulnerability in Simple Terms
The Portfolio and Projects plugin for WordPress fails to properly check user permissions before allowing modifications to project data. A logged-in user with low privileges can alter projects they should not have access to. The vulnerability affects versions up to 1.3.7. Update to a version newer than 1.3.7 to resolve this issue.
What an attacker can do
Modify or alter projects without proper authorization.
Potential impact on your site
Unauthorized users can change project content, potentially corrupting or defacing project data.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account on the site.
Key dates
External resources
Related vulnerabilities
