CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in DBAR Productions Member Directory and Contact Form pta-member-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Member Directory and Contact Form: from n/a through <= 1.7.0.
Explanation of Vulnerability in Simple Terms
Member Directory and Contact Form versions 1.7.0 and earlier lack proper authorization checks on certain operations. A logged-in user with low privileges can modify data they should not have access to. The vulnerability does not affect confidentiality or system availability, only data integrity.
What an attacker can do
Modify data in the plugin that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can alter directory or form data, potentially corrupting or defacing user-submitted information.
Conditions required to exploit
Attacker must have a low-privilege account on the site and be logged in.
Key dates
External resources
Related vulnerabilities
