CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_wpqai_disconnect_quicq_afosto' AJAX endpoint in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect Afosto
Explanation of Vulnerability in Simple Terms
The Convert WebP & AVIF plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify data they should not have access to. An attacker with a basic user account can alter site content or settings through an unprotected function. The vulnerability affects versions up to 2.0.0 and requires an active user login to exploit.
What an attacker can do
Modify site data or settings without proper authorization using a low-privilege user account.
Potential impact on your site
Unauthorized users can alter plugin settings or related site data, potentially affecting image optimization and site functionality.
Conditions required to exploit
Attacker must have a valid WordPress user account with low privileges (e.g., subscriber or contributor role).
Key dates
External resources
