CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through <= 1.1.0.
Explanation of Vulnerability in Simple Terms
The Comment Blacklist Updater plugin for WordPress contains a missing authorization check that allows unauthenticated attackers to modify the plugin's settings. An attacker can change the blacklist configuration without logging in, potentially disabling comment filtering or injecting malicious content rules. This affects all versions up to 1.1.0.
What an attacker can do
Modify the plugin's comment blacklist settings without authentication.
Potential impact on your site
Attackers can disable comment filtering or alter blacklist rules, allowing spam or malicious comments to be posted.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
