CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.
Explanation of Vulnerability in Simple Terms
GeoDirectory versions up to 2.3.70 lack proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify data they should not have access to. The vulnerability does not affect confidentiality or availability, only data integrity. Update to a version newer than 2.3.70.
What an attacker can do
Modify data or settings they should not have permission to change.
Potential impact on your site
Unauthorized users can alter directory listings, settings, or other protected content.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
