CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The The Bucketlister plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bucketlister_do_admin_ajax() function in all versions up to, and including, 0.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add delete or modify arbitrary bucket list items.
Explanation of Vulnerability in Simple Terms
The Bucketlister through version 0.1.5 lacks proper authorization checks, allowing authenticated users to modify data they should not have access to. An attacker with a low-privilege account can change information without the application verifying their permissions. This affects the integrity of stored data but does not expose sensitive information or cause service disruption.
What an attacker can do
Modify data belonging to other users or restricted areas of the application.
Potential impact on your site
Data integrity is at risk; users' information may be altered by unauthorized accounts without detection.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges; no user interaction required.
Key dates
External resources
