CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.3.
Explanation of Vulnerability in Simple Terms
The GDPR CCPA Compliance Support plugin through version 2.7.3 fails to properly check user permissions before allowing access to sensitive compliance data. A logged-in user with low privileges can read information they should not have access to. The vulnerability does not allow data modification or system unavailability.
What an attacker can do
Read compliance data and settings they should not have access to.
Potential impact on your site
User data and compliance settings may be exposed to low-privilege site members.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
