CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Flow-Flow Social Feed Stream plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flow_flow_social_auth AJAX action in versions 3.0.0 to 4.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings and store arbitrary JavaScript that executes whenever the plugin settings page is viewed.
Explanation of Vulnerability in Simple Terms
Flow-Flow Social Feed Stream versions 3.0.0 through 4.7.5 lack proper authorization checks, allowing authenticated users to access or modify data they should not have permission to view or change. The vulnerability affects multiple data types and can impact site confidentiality and integrity. Users should update to a version newer than 4.7.5.
What an attacker can do
Read or modify data belonging to other users or site areas without proper authorization.
Potential impact on your site
Authenticated users can access or alter sensitive data across your site, potentially exposing user information or corrupting content.
Conditions required to exploit
Attacker must have a valid user account on the site with at least low-level privileges.
Key dates
External resources
