CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Make Website Members Only" feature (when unset) and view restricted page and post content.
Explanation of Vulnerability in Simple Terms
The WordPress Access Control plugin through version 4.0.13 contains an access control flaw that allows unauthenticated attackers to read sensitive information. The plugin fails to properly restrict access to certain data, exposing confidential details to anyone on the network. Site administrators should update the plugin immediately to a version newer than 4.0.13.
What an attacker can do
Read sensitive information from the site without logging in.
Potential impact on your site
Confidential data may be exposed to the public, including information not intended for unauthenticated users.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
