CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in Automattic Newspack Content Converter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Content Converter: from n/a through 0.1.5.
Explanation of Vulnerability in Simple Terms
Newspack Content Converter versions up to 0.1.5 lack proper authorization checks, allowing authenticated users with low privileges to modify content they should not have access to. An attacker with a basic user account can change or delete posts and pages belonging to other users or protected content areas. This vulnerability affects any WordPress site using the plugin where user roles and permissions are relied upon to restrict editing capabilities.
What an attacker can do
Modify or delete posts and pages belonging to other users or restricted content areas.
Potential impact on your site
Content integrity is at risk; unauthorized users can alter or remove published posts, pages, and other content.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., Contributor or Author) on the WordPress site.
Key dates
External resources
Related vulnerabilities
