CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'seedprod_lite_get_revisisons' function in all versions up to, and including, 6.18.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the content of arbitrary landing page revisions.
Explanation of Vulnerability in Simple Terms
Website Builder by SeedProd versions up to 6.18.15 fail to properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read sensitive information they should not have access to. Update to a version newer than 6.18.15 to resolve this issue.
What an attacker can do
Read sensitive data they should not have access to as a low-privilege user.
Potential impact on your site
Low-privilege users can view confidential information, risking data exposure and privacy violations.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
