CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_reset_capability' AJAX endpoint in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to reset any user's capabilities.
Explanation of Vulnerability in Simple Terms
Simple User Capabilities versions 1.0 and earlier contain an authorization bypass that allows unauthenticated attackers to modify data on the site. The vulnerability stems from missing access control checks on certain functions. No user interaction is required to exploit this issue.
What an attacker can do
Modify site data without authentication or permission.
Potential impact on your site
Unauthorized users can alter site content or settings, potentially defacing pages or changing configurations.
Conditions required to exploit
Network access to the site; no authentication required.
Key dates
External resources
