CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Explanation of Vulnerability in Simple Terms
A privilege escalation vulnerability in Dynamics 365 Integration versions up to 1.3.23 allows authenticated users with low privileges to gain high-level access to the system. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component itself. An attacker can read sensitive data, modify system configuration, and disrupt service availability.
What an attacker can do
Read sensitive data, modify system settings, and disrupt service availability across the affected system.
Potential impact on your site
Any authenticated user can escalate their privileges to read, modify, or delete critical data and configurations.
Conditions required to exploit
Attacker must have a low-privilege authenticated account and network access to the application.
Key dates
External resources
Related vulnerabilities
