CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.4.
Explanation of Vulnerability in Simple Terms
WP Accessibility Helper versions up to 0.6.2.4 lack proper authorization checks, allowing authenticated users to modify site settings they should not have access to. An attacker with a low-privilege account can change configuration options without proper permission validation. The vulnerability affects the plugin's settings functionality and requires an active user account to exploit.
What an attacker can do
Modify plugin settings and configuration without proper authorization.
Potential impact on your site
Unauthorized users can alter accessibility helper settings, potentially affecting site functionality and user experience.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
