CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Automattic Newspack Blocks newspack-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Blocks: from n/a through 3.0.8.
Explanation of Vulnerability in Simple Terms
Newspack Blocks versions up to 3.0.8 lack proper authorization checks, allowing authenticated users with low privileges to modify or delete content they should not have access to. The vulnerability requires a valid WordPress account but no special permissions. Site administrators should update to a version newer than 3.0.8 to restore proper access controls.
What an attacker can do
Modify or delete content without proper authorization.
Potential impact on your site
Unauthorized users can alter or remove published content, potentially disrupting site integrity.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges.
Key dates
External resources
Related vulnerabilities
