CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in UX Design Experts Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin experto-cta-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin: from n/a through <= 1.1.1.
Explanation of Vulnerability in Simple Terms
The Experto CTA Widget plugin for WordPress fails to properly check user permissions before allowing modifications to call-to-action settings. An unauthenticated attacker can modify widget configuration over the network without needing to log in or interact with a site administrator. This affects all versions up to 1.1.1.
What an attacker can do
Modify call-to-action widget settings and content without authentication.
Potential impact on your site
Attackers can deface or redirect your CTA buttons and floating elements without your knowledge or permission.
Conditions required to exploit
Network access to the WordPress site; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
