CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.12.
Explanation of Vulnerability in Simple Terms
Premmerce User Roles versions 1.0.12 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify site data and functionality. An attacker with a basic user account can change settings, alter content, or disable features that should be restricted to administrators. This affects any site using the plugin without restricting user roles appropriately.
What an attacker can do
Modify site settings and content that should be restricted to administrators.
Potential impact on your site
Unauthorized users can alter critical site configuration, content, or disable features without admin approval.
Conditions required to exploit
Attacker needs a low-privilege user account on the site; no special interaction required.
Key dates
External resources
Related vulnerabilities
