CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in E-goi Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Marketing SMS and Newsletters Forms: from n/a through <= 5.0.4.
Explanation of Vulnerability in Simple Terms
The E-goi Smart Marketing SMS and Newsletters Forms plugin fails to properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify data they should not have access to. The vulnerability affects versions up to 5.0.4. Update to a version newer than 5.0.4 to resolve this issue.
What an attacker can do
Modify data or settings they should not have permission to change.
Potential impact on your site
Unauthorized users can alter plugin settings, form data, or configurations without proper authorization.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
