CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through <= 4.5.0.4.
Explanation of Vulnerability in Simple Terms
The GEO my WordPress plugin through version 4.5.0.4 lacks proper authorization checks on certain functions. A logged-in user with low privileges can read sensitive data they should not have access to. The vulnerability requires valid WordPress credentials but no special interaction. Update to a version newer than 4.5.0.4.
What an attacker can do
Read sensitive data from the plugin that should be restricted to higher-privilege users.
Potential impact on your site
Any registered user on your site can access confidential plugin data, potentially exposing site configuration or other users' information.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
