CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.
Explanation of Vulnerability in Simple Terms
The Lafka Plugin for AlThemist contains an authorization bypass that allows authenticated users to modify data they should not have access to. An attacker with a low-privilege account can change content or settings without proper permission checks. The vulnerability affects versions up to 7.1.0 and requires an active user account to exploit.
What an attacker can do
Modify or change data and settings without proper authorization.
Potential impact on your site
Authenticated users can alter content, settings, or other data beyond their intended permissions.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
