CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.
Explanation of Vulnerability in Simple Terms
The Miraculous Core Plugin versions 2.0.9 and earlier contain a critical vulnerability that allows unauthenticated attackers to read sensitive data, modify site content, or disrupt service without any user interaction. The vulnerability stems from improper access control, enabling remote exploitation over the network. All sites running affected versions require immediate patching.
What an attacker can do
Read sensitive data, modify content, or disable the site without logging in.
Potential impact on your site
Attackers can compromise your site's data, content, and availability without any barrier to entry.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
