CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing authorization validation on the employee_spotlight_check_optin() function in all versions up to, and including, 5.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable tracking settings.
Explanation of Vulnerability in Simple Terms
The Employee Spotlight plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify data they should not have access to. An attacker with a basic user account can alter team member information or other plugin data without proper permission checks. The vulnerability affects versions up to 5.1.3 and requires a valid WordPress login to exploit.
What an attacker can do
Modify team member profiles and plugin data without proper authorization.
Potential impact on your site
Unauthorized changes to team member information, potentially damaging site credibility and requiring manual restoration.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
