CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through <= 1.2.7.
Explanation of Vulnerability in Simple Terms
The WP Free SSL plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify settings or data they should not have access to. The vulnerability affects all versions up to 1.2.7. Site administrators should update the plugin as soon as a patched version is available.
What an attacker can do
A low-privilege logged-in user can modify plugin settings or data without proper authorization.
Potential impact on your site
Unauthorized users can alter SSL certificate settings or related configurations on your site.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
