CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in cl272 Enhanced Text Widget enhanced-text-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through <= 1.6.3.
Explanation of Vulnerability in Simple Terms
The Enhanced Text Widget for WordPress contains a missing authorization flaw that allows unauthenticated attackers to modify widget content over the network. An attacker can change text displayed on the site without needing to log in or interact with a user. This affects all versions up to 1.6.3. Site owners should update to a version newer than 1.6.3 to prevent unauthorized content changes.
What an attacker can do
Modify widget text content on the site without authentication.
Potential impact on your site
Attackers can alter widget text displayed to visitors, potentially injecting misleading or malicious content.
Conditions required to exploit
Network access only; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
