CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6.
Explanation of Vulnerability in Simple Terms
The miniOrange WordPress Social Login plugin versions up to 7.6.6 contain a privilege management flaw that allows authenticated users with low privileges to perform actions reserved for administrators. An attacker with a standard user account can read sensitive data, modify site content, or disrupt service by exploiting improper role checks. The vulnerability requires the attacker to interact with a malicious link or page.
What an attacker can do
Read sensitive data, modify site content, or disrupt service with a low-privilege user account.
Potential impact on your site
Unauthorized users can escalate privileges and access admin functions, compromising site integrity and confidentiality.
Conditions required to exploit
Attacker needs a valid low-privilege WordPress user account and must trick a user into clicking a malicious link.
Key dates
External resources
Related vulnerabilities
