CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctl_create_link AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts and subsequently log in as those.
Explanation of Vulnerability in Simple Terms
Bifröst versions up to 1.0.7 lack proper authorization checks, allowing authenticated users to perform actions they should not have access to. An attacker with low-level credentials can read, modify, or delete sensitive data and functionality across the application. This affects the core security model of the passwordless login system.
What an attacker can do
Read, modify, or delete data and functionality they should not have access to.
Potential impact on your site
Compromised user accounts can escalate privileges and access or alter sensitive site data.
Conditions required to exploit
Attacker must have a valid low-level user account on the site.
Key dates
External resources
