CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Missing Authorization vulnerability in AWEOS GmbH Email Notifications for Updates wp-update-mail-notification allows Privilege Escalation.This issue affects Email Notifications for Updates: from n/a through <= 1.1.6.
Explanation of Vulnerability in Simple Terms
Email Notifications for Updates versions 1.1.6 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete data they should not access. An attacker with a basic user account can perform actions restricted to administrators. The vulnerability affects all data handled by the plugin and requires only network access and valid login credentials.
What an attacker can do
Read, modify, or delete sensitive data and perform admin-level actions with a low-privilege user account.
Potential impact on your site
Any low-privilege user can access and modify plugin settings, email configurations, and potentially other site data.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site; no special user interaction required.
Key dates
External resources
