CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘export_settings’ function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary options on affected sites.
Explanation of Vulnerability in Simple Terms
The Login/Signup Popup plugin for WordPress versions 2.7.1 through 2.7.2 contains an information disclosure vulnerability. An authenticated user with low privileges can read sensitive data they should not have access to. The vulnerability requires network access and does not require user interaction. Update to a version newer than 2.7.2 to resolve this issue.
What an attacker can do
Read sensitive data accessible through the plugin that should be restricted from their user role.
Potential impact on your site
Authenticated users can access information beyond their permission level, risking exposure of private site data.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
