CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.
Explanation of Vulnerability in Simple Terms
Simple User Capabilities version 1.0 and earlier contains a missing authorization flaw that allows unauthenticated attackers to read, modify, or delete data on the site without any restrictions. The vulnerability requires only network access and no user interaction. An attacker can exploit this remotely to gain full control over sensitive information and site functionality.
What an attacker can do
Read, modify, or delete any data on the site without authentication.
Potential impact on your site
Complete compromise of site data, user information, and functionality without any warning or authentication barrier.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
