CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
What the vulnerability does
Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Project Cost Calculator: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
Project Cost Calculator versions 1.0.0 and earlier contain an authorization bypass that allows authenticated users to modify or delete data they should not have access to. An attacker with low-privilege account access can trigger actions that affect site availability and data integrity. No user interaction is required once the attacker is logged in.
What an attacker can do
Modify or delete data and disrupt site availability with a low-privilege account.
Potential impact on your site
Authenticated users can corrupt or delete project cost data and cause service disruption without proper access controls.
Conditions required to exploit
Attacker must have a valid user account with low-level permissions on the site.
Key dates
External resources
