CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks on the `cwpp_trigger_flush_rewrite_rules` function hooked to `wp_ajax_cwpp_trigger_flush_rewrite_rules`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to flush the site's rewrite rules via the `action` parameter.
Explanation of Vulnerability in Simple Terms
The WP Page Permalink Extension through version 1.5.4 lacks proper authorization checks, allowing unauthenticated attackers to modify page permalinks and availability settings. An attacker can change how pages are accessed or disable them without needing to log in. Site administrators should update to a version newer than 1.5.4 immediately.
What an attacker can do
Modify page permalinks and disable pages without authentication.
Potential impact on your site
Attackers can alter page URLs and take pages offline, disrupting site navigation and availability.
Conditions required to exploit
Network access only; no login or user interaction required.
Key dates
External resources
