CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Explanation of Vulnerability in Simple Terms
The Sala WordPress theme contains a critical vulnerability that allows unauthenticated attackers to read sensitive data, modify site content, and disrupt service without requiring user interaction. The flaw affects all versions up to 1.1.4. Site administrators should update immediately to a patched version.
What an attacker can do
Read sensitive data, modify or delete site content, and disable the site without authentication.
Potential impact on your site
Your site's data, content, and availability are at immediate risk from remote attackers.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
