CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through <= 2.1.3.
Explanation of Vulnerability in Simple Terms
The News Ticker for Elementor plugin fails to properly check user permissions before allowing modifications to ticker settings. A logged-in user with low privileges can change ticker content and configuration without authorization. The vulnerability affects all versions up to 2.1.3. Update to a version newer than 2.1.3 to resolve this issue.
What an attacker can do
Modify news ticker content and settings without proper authorization.
Potential impact on your site
Unauthorized users can alter ticker content, potentially spreading misinformation or defacing the site.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
