CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator.
Explanation of Vulnerability in Simple Terms
WP Directorybox Manager versions 2.5 and earlier contain an authentication bypass vulnerability. An attacker can gain unauthorized access to the plugin without valid credentials, potentially compromising the entire site. The vulnerability requires no user interaction and can be exploited remotely. Site administrators should update immediately to a patched version.
What an attacker can do
Gain full unauthorized access to the site without valid login credentials.
Potential impact on your site
Complete site compromise possible, including data theft, malware injection, and account takeover.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
