CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Zotpress_process_accounts_AJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin's settings.
Explanation of Vulnerability in Simple Terms
Zotpress versions up to 7.3.12 contain an access control flaw that allows authenticated users to modify data they should not have permission to change. The vulnerability requires a valid user account and network access but does not require user interaction. A low-privileged user can exploit this to alter information within the application.
What an attacker can do
Modify data or settings that should be restricted to higher-privileged users.
Potential impact on your site
Unauthorized changes to site data by low-privileged users; potential data integrity issues.
Conditions required to exploit
Valid user account with low-level privileges; network access to the application.
Key dates
External resources
Related vulnerabilities
