CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Htaccess File Editor: from n/a through <= 1.0.18.
Explanation of Vulnerability in Simple Terms
The Htaccess File Editor plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify .htaccess files and disable site features. An attacker with a basic user account can change critical server configuration without proper permission checks. This affects all versions up to 1.0.18.
What an attacker can do
Modify .htaccess files to disable site features or alter server behavior.
Potential impact on your site
Unauthorized users can alter server configuration, potentially breaking site functionality or security rules.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., Subscriber or Contributor).
Key dates
External resources
Related vulnerabilities
