CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
What the vulnerability does
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.3 via the 'nxs_getExpSettings' function. This makes it possible for authenticated attackers, with subscriber access and above, to extract sensitive data including social network API keys and secrets.
Explanation of Vulnerability in Simple Terms
NextScripts: Social Networks Auto-Poster versions 4.4.3 and earlier contain an authorization flaw that allows authenticated users with low privileges to read sensitive data across the application and make limited modifications. The vulnerability affects the scope beyond the vulnerable component itself. An attacker needs a valid user account to exploit this issue.
What an attacker can do
Read sensitive data from other users or parts of the site and make limited changes to content.
Potential impact on your site
Authenticated users can access confidential information and modify data they should not have permission to change.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
