CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) popup-surveys allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Surveys & Polls for WordPress (Mare.io): from n/a through <= 1.36.
Explanation of Vulnerability in Simple Terms
The Popup Surveys & Polls for WordPress plugin through version 1.36 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify or delete survey data and settings without proper permission validation. This allows unauthorized changes to site content and functionality that should be restricted to administrators.
What an attacker can do
Modify or delete surveys and poll data without admin permission.
Potential impact on your site
Unauthorized users can alter or remove surveys, disrupting site functionality and data integrity.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
