CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.
Explanation of Vulnerability in Simple Terms
The WordPress Single Sign-On plugin versions 18.5.3 and earlier contain an authorization flaw that allows unauthenticated attackers to read limited sensitive information over the network. The vulnerability requires no user interaction and affects the confidentiality of data accessible through the plugin. Site administrators should update to a version newer than 18.5.3.
What an attacker can do
Read limited sensitive information from the plugin without authentication.
Potential impact on your site
Unauthorized users can access certain sensitive data handled by the SSO plugin.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
