CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteUserCcDraftPost' function in all versions up to, and including, 8.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the status of arbitrary posts to trash.
Explanation of Vulnerability in Simple Terms
Blog2Social contains a missing authorization flaw that allows authenticated users with low privileges to modify or delete data they should not have access to. An attacker with a standard user account can perform unauthorized actions affecting site content and availability. The vulnerability affects versions up to 8.7.0 and requires a valid login to exploit.
What an attacker can do
Modify or delete site data without proper authorization using a low-privilege user account.
Potential impact on your site
Unauthorized users can alter or remove content, potentially disrupting site operations and data integrity.
Conditions required to exploit
Attacker must have a valid user account with low privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
