CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as pages and allows them to execute other actions related to auction handling.
Explanation of Vulnerability in Simple Terms
The Ultimate WordPress Auction Plugin through version 4.2.9 contains an input validation flaw that allows authenticated users to read or modify data they should not have access to. An attacker with a low-privilege account can exploit this over the network without user interaction. The vulnerability affects confidentiality and integrity but not availability.
What an attacker can do
Read or modify auction data and settings with a low-privilege WordPress account.
Potential impact on your site
Auction data and plugin settings may be exposed or altered by any authenticated user, compromising auction integrity.
Conditions required to exploit
Attacker must have a valid low-privilege WordPress user account; no user interaction required.
Key dates
External resources
Related vulnerabilities
