CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'kbs_ajax_load_front_end_replies' and 'kbs_ajax_mark_reply_as_read' functions in all versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to read replies of any ticket, and mark any reply as read.
Explanation of Vulnerability in Simple Terms
The KB Support plugin for WordPress fails to properly check user permissions before allowing access to sensitive support ticket and knowledge base data. An attacker without authentication can read and modify ticket information and knowledge base content. This affects all versions up to 1.6.6. Site administrators should update immediately to a version newer than 1.6.6.
What an attacker can do
Read and modify support tickets and knowledge base content without logging in.
Potential impact on your site
Customer support tickets and knowledge base articles are exposed to unauthorized viewing and modification.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
