CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reorder_route() function in all versions up to, and including, 3.0.13. This makes it possible for unauthenticated attackers to reorder posts.
Explanation of Vulnerability in Simple Terms
The Ultimate WordPress Toolkit plugin for WordPress contains a missing authorization check that allows unauthenticated attackers to modify data on the site. An attacker can send a network request to trigger the vulnerability without needing to log in or interact with a site administrator. The integrity of site content or settings may be compromised. Update to a version newer than 3.0.13.
What an attacker can do
Modify site data or settings without logging in.
Potential impact on your site
Attackers can alter site content, settings, or data without a valid account.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
