CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's form. This makes it possible for unauthenticated attackers to register and manage the plugin's settings.
Explanation of Vulnerability in Simple Terms
Binary MLM Plan versions 3.0 and earlier contain an improper privilege or access control flaw that allows unauthenticated attackers to read and modify sensitive data over the network. No user interaction is required. The vulnerability affects confidentiality and integrity but not availability.
What an attacker can do
Read and modify sensitive data without authentication.
Potential impact on your site
Attackers can access and alter data in your MLM system without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
