CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.
Explanation of Vulnerability in Simple Terms
The Grand Conference Theme Custom Post Type for WordPress contains an authorization bypass that allows authenticated users with low privileges to modify or delete content they should not have access to. The vulnerability affects versions up to 2.6.4 and requires a logged-in account to exploit. Site administrators should update to a version newer than 2.6.4 to remediate the issue.
What an attacker can do
Modify or delete posts and content without proper permission checks.
Potential impact on your site
Unauthorized users can alter or remove site content, potentially disrupting your site or exposing sensitive information.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
