CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Author-level access and above, to enable or disable arbitrary SiteSEO features that they should not have access to.
Explanation of Vulnerability in Simple Terms
SiteSEO versions 1.3.1 and earlier contain an improper access control vulnerability. An attacker with low-level user privileges can modify data they should not have access to. The vulnerability requires network access and valid user credentials but no additional user interaction. Site administrators should update to a version newer than 1.3.1.
What an attacker can do
Modify data on the site that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized changes to site content or settings by low-privilege users or compromised accounts.
Conditions required to exploit
Valid low-level user account on the site; network access.
Key dates
External resources
Related vulnerabilities
