CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
Explanation of Vulnerability in Simple Terms
The Frontend Post Submission Manager Lite plugin for WordPress does not properly check user permissions before allowing certain actions. An unauthenticated attacker can modify post data without authorization. The vulnerability affects all versions up to 1.2.6. Site administrators should update the plugin immediately when a patched version becomes available.
What an attacker can do
Modify post content or metadata without logging in or having permission to do so.
Potential impact on your site
Attackers can alter published posts, drafts, or post metadata without your knowledge or consent.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
