CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
What the vulnerability does
The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_testimonials_option_callback' function in versions up to, and including, 10.2.0. This makes it possible for unauthenticated attackers to update the OpenAI API key, disabling the feature.
Explanation of Vulnerability in Simple Terms
The Testimonial Carousel For Elementor plugin for WordPress does not properly check user permissions before allowing certain actions. An unauthenticated attacker can make requests to the site that cause a denial of service by consuming server resources. Update to a version newer than 10.2.0.
What an attacker can do
Make unauthenticated requests that degrade site performance or cause temporary unavailability.
Potential impact on your site
Site may become slow or unresponsive during an attack; no data theft or modification.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
