CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_bhf_post function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages or posts with arbitrary content.
Explanation of Vulnerability in Simple Terms
The Boostify Header Footer Builder for Elementor plugin through version 1.3.5 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify plugin settings or data without the required permissions. The vulnerability requires an active user account but no special interaction from the victim.
What an attacker can do
Modify plugin settings or data without proper authorization as a low-privilege user.
Potential impact on your site
Unauthorized users can alter header/footer content or plugin configuration, potentially defacing the site or injecting malicious content.
Conditions required to exploit
Attacker must have a valid user account with low-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
