CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Ace Post Type Builder plugin for WordPress is vulnerable to unauthorized custom taxonomy deletion due to missing authorization validation on the cptb_delete_custom_taxonomy() function in all versions up to, and including, 1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary custom taxonomies.
Explanation of Vulnerability in Simple Terms
Ace Post Type Builder versions 1.9 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify site content. The vulnerability does not require user interaction or special network conditions. Site administrators should update to a version newer than 1.9 as soon as a patch becomes available.
What an attacker can do
Modify or alter site content without authentication.
Potential impact on your site
Unauthorized users can change post types and related content, potentially defacing or corrupting your site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
