CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through <= 2.1.
Explanation of Vulnerability in Simple Terms
The Import YouTube videos as WP Posts plugin through version 2.1 lacks proper authorization checks on its core functionality. An unauthenticated attacker can modify or create posts by sending direct requests to the plugin's endpoints. This allows unauthorized content manipulation on affected WordPress sites without requiring a valid user account.
What an attacker can do
Create or modify WordPress posts without a valid user account.
Potential impact on your site
Attackers can inject malicious content, spam, or phishing links directly into your site's posts.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
