CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.
Explanation of Vulnerability in Simple Terms
Sticky Notes for WP Dashboard versions 1.2.4 and earlier lack proper authorization checks, allowing authenticated users to read sensitive note data they should not access. An attacker with a low-privilege WordPress account can view other users' sticky notes without additional interaction. Update to a version newer than 1.2.4 to resolve this issue.
What an attacker can do
Read other users' sticky notes and any sensitive information stored in them.
Potential impact on your site
Private notes and sensitive information stored by site admins or editors may be exposed to lower-privilege users.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
