CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user->set_role() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Explanation of Vulnerability in Simple Terms
DirectoryThemes Tiger versions up to 101.2.1 contain a privilege management flaw that allows authenticated users with low-level access to gain unauthorized elevated privileges. An attacker with a basic user account can read, modify, or delete sensitive data and disrupt site operations. The vulnerability requires network access and a valid login but no additional user interaction.
What an attacker can do
Read, modify, or delete sensitive data; disrupt site availability with a low-privilege user account.
Potential impact on your site
Authenticated users can escalate privileges and compromise site data, user accounts, and availability.
Conditions required to exploit
Valid login credentials with low-level user privileges; network access to the site.
Key dates
External resources
