CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to create/edit/delete Soumettre posts. This vulnerability affects only installations where the soumettre account is not connected (i.e. API key is not installed)
Explanation of Vulnerability in Simple Terms
Soumettre.fr versions 2.1.5 and earlier contain an integrity vulnerability that allows an attacker to modify data in transit over the network. The vulnerability requires specific network conditions to exploit and does not affect confidentiality or availability. Users should update to a version newer than 2.1.5 when available.
What an attacker can do
Modify data sent to or from the site under specific network conditions.
Potential impact on your site
Data integrity cannot be guaranteed for affected versions; updates should be applied when available.
Conditions required to exploit
Network access and specific attack conditions; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
