CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
What the vulnerability does
Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through <= 1.1.0.
Explanation of Vulnerability in Simple Terms
DefendWP Firewall versions 1.1.0 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify firewall settings and rules they should not access. An attacker can change integrity-critical configurations, read some firewall data, and disrupt availability. The vulnerability requires a valid user account but no special interaction.
What an attacker can do
Modify firewall rules and settings, read firewall logs, and disrupt site protection without proper authorization.
Potential impact on your site
Firewall protection can be disabled or misconfigured by low-privilege users, exposing the site to attacks.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
