CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Blocksera Cryptocurrency Widgets Pack cryptocurrency-widgets-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets Pack: from n/a through <= 2.0.1.
Explanation of Vulnerability in Simple Terms
The Cryptocurrency Widgets Pack for Blocksera contains an authorization flaw that allows authenticated users with low privileges to read sensitive data they should not access. An attacker with a basic user account can retrieve confidential information through the plugin's API or interface without additional restrictions. This affects all versions up to 2.0.1. Update to a version newer than 2.0.1 when available.
What an attacker can do
Read sensitive data accessible only to higher-privileged users or administrators.
Potential impact on your site
Confidential site data may be exposed to any registered user, including cryptocurrency wallet info or transaction details.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
