CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views.
Explanation of Vulnerability in Simple Terms
Strong Testimonials through version 3.1.12 contains an access control flaw that allows authenticated users with low privileges to modify data they should not have permission to change. The vulnerability requires a valid user account but no special interaction. Site administrators should update to a version newer than 3.1.12 to prevent unauthorized data modification by low-privilege users.
What an attacker can do
Modify testimonials or plugin data without proper authorization.
Potential impact on your site
Low-privilege users can alter testimonials or settings they shouldn't access, compromising data integrity.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
