CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function in versions 0.3.4 to 0.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Explanation of Vulnerability in Simple Terms
WP-GeoMeta versions 0.3.4 through 0.3.5 contain an improper access control vulnerability that allows authenticated users with low privileges to read, modify, or delete sensitive data and disrupt site functionality. An attacker with a standard user account can exploit this flaw without user interaction. The vulnerability affects the core functionality of the plugin and requires immediate patching.
What an attacker can do
Read, modify, or delete sensitive data; disrupt site availability with a low-privilege user account.
Potential impact on your site
Unauthorized data access, modification, or deletion by any registered user; potential site downtime.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
