CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Syed Balkhi ExactMetrics google-analytics-dashboard-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ExactMetrics: from n/a through <= 8.1.0.
Explanation of Vulnerability in Simple Terms
ExactMetrics versions up to 8.1.0 lack proper authorization checks, allowing authenticated users with low privileges to read and modify sensitive data they should not access. An attacker with a basic user account can view or alter analytics information and settings without restriction. Update to a version newer than 8.1.0 to restore proper access controls.
What an attacker can do
Read and modify analytics data and settings without proper authorization.
Potential impact on your site
Unauthorized users can access and alter your analytics configuration and data.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
