CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorization checks in the quotecomments_add_admin function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options via the 'action' parameter.
Explanation of Vulnerability in Simple Terms
Quote Comments versions 3.0.0 and earlier lack proper authorization checks, allowing authenticated users to modify comments they should not have access to. An attacker with a low-privilege account can alter or tamper with comments belonging to other users. The vulnerability requires an active user account but no special interaction from victims.
What an attacker can do
Modify or tamper with comments posted by other users on the site.
Potential impact on your site
User comments can be altered by unauthorized accounts, compromising comment integrity and user trust.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
