CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
What the vulnerability does
Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6.
Explanation of Vulnerability in Simple Terms
Contact Form to Any API versions up to 1.1.6 lack proper authorization checks on certain operations. An authenticated user with low privileges can trigger actions they should not have access to, potentially disrupting site functionality. The vulnerability requires a valid user account but no special interaction from other users.
What an attacker can do
Disrupt site availability by triggering unauthorized operations as a low-privilege authenticated user.
Potential impact on your site
A low-privilege user (subscriber, contributor) can perform actions restricted to higher roles, affecting site stability.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
