CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Greg - SiteOrigin SiteOrigin Widgets Bundle so-widgets-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteOrigin Widgets Bundle: from n/a through <= 1.64.0.
Explanation of Vulnerability in Simple Terms
The SiteOrigin Widgets Bundle for WordPress does not properly check user permissions before allowing access to certain functionality. A logged-in user with low privileges can read sensitive information they should not have access to. The vulnerability affects all versions up to and including 1.64.0.
What an attacker can do
Read sensitive information that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can access private or restricted data within the plugin, potentially exposing site configuration or user information.
Conditions required to exploit
Attacker must be logged in to the WordPress site with a low-privilege account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
