CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in JustCoded / Alex Prokopenko Just Custom Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Custom Fields: from n/a through 3.3.2.
Explanation of Vulnerability in Simple Terms
Just Custom Fields through version 3.3.2 fails to properly check user permissions before allowing modifications to custom field data. A logged-in user with low privileges can alter custom fields they should not have access to. The vulnerability does not expose sensitive data or crash the site, but allows unauthorized changes to site content.
What an attacker can do
Modify custom field data on the site without proper authorization.
Potential impact on your site
Unauthorized users can alter custom field content, potentially corrupting data or modifying site information.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
