CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a through 6.2.
Explanation of Vulnerability in Simple Terms
WP EXtra versions 6.2 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or disrupt site data. An attacker with a standard user account can access functionality that should be restricted to administrators. Update to a version newer than 6.2 to resolve this issue.
What an attacker can do
Read, modify, or disrupt site data with a low-privilege user account.
Potential impact on your site
Unauthorized users can access admin-level features, risking data exposure and site integrity.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
