CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator.
Explanation of Vulnerability in Simple Terms
The Configurator Theme Core contains a privilege management flaw that allows authenticated users with low-level access to perform actions restricted to higher-privilege roles. An attacker with a basic user account can read, modify, or delete sensitive site data and configuration. This affects all versions up to 1.4.7. Update immediately to a version newer than 1.4.7.
What an attacker can do
Read, modify, or delete site data and settings with a low-privilege user account.
Potential impact on your site
Any registered user can escalate their access to perform admin-level actions without authorization.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
