CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in yonifre Maspik – Spam blacklist contact-forms-anti-spam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Maspik – Spam blacklist: from n/a through <= 2.2.7.
Explanation of Vulnerability in Simple Terms
Maspik – Spam blacklist versions 2.2.7 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify or disable spam filtering rules. An attacker with a basic user account can alter the blacklist configuration, potentially allowing spam or malicious content to reach the site. The vulnerability requires valid login credentials but no special permissions.
What an attacker can do
Modify spam blacklist rules or disable filtering to allow unwanted content through.
Potential impact on your site
Spam filtering can be bypassed or disabled by any authenticated user, compromising content moderation.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
