CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' function in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's log files.
Explanation of Vulnerability in Simple Terms
The SendGrid for WordPress plugin versions 1.4 and earlier lack proper authorization checks on certain functions. A logged-in user with low privileges can modify settings or data they should not have access to. The vulnerability requires an active WordPress account but no special interaction from other users.
What an attacker can do
Modify plugin settings or data without proper permission as a low-privilege logged-in user.
Potential impact on your site
Unauthorized users can alter SendGrid plugin configuration, potentially disrupting email delivery or exposing API settings.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
