CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
What the vulnerability does
The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handel_ajax_req() function in versions 1.9.1 to 7.5.2. This makes it possible for unauthenticated attackers to update arbitrary user's metadata which can be leveraged to block an administrator from accessing their site when wp_capabilities is set to 0.
Explanation of Vulnerability in Simple Terms
PeproDev Ultimate Profile Solutions versions 1.9.1 through 7.5.2 contain an integrity vulnerability that allows unauthenticated attackers to modify data over the network without user interaction. The flaw stems from insufficient access controls (CWE-285). Affected sites should update immediately to a version newer than 7.5.2.
What an attacker can do
Modify data on the site without logging in or user interaction.
Potential impact on your site
Attackers can alter site content, user data, or settings without authorization.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
