CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Frank P. Walentynowicz FPW Category Thumbnails fpw-category-thumbnails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FPW Category Thumbnails: from n/a through <= 1.9.5.
Explanation of Vulnerability in Simple Terms
FPW Category Thumbnails versions 1.9.5 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete data they should not access. The vulnerability requires a valid user account but no special permissions. Site administrators should update to a version newer than 1.9.5 to restrict unauthorized data access.
What an attacker can do
Read, modify, or delete data without proper authorization as a low-privilege authenticated user.
Potential impact on your site
Authenticated users can access or alter sensitive data beyond their intended permissions, risking data integrity and confidentiality.
Conditions required to exploit
Attacker must have a valid user account with low privileges on the site.
Key dates
External resources
