CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in approveme Signature Add-On for Gravity Forms gravity-signature-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Signature Add-On for Gravity Forms: from n/a through <= 1.8.6.
Explanation of Vulnerability in Simple Terms
The Signature Add-On for Gravity Forms versions 1.8.6 and earlier lack proper authorization checks on certain operations. A logged-in user with low privileges can modify data they should not have access to. The vulnerability does not affect confidentiality or availability, only data integrity. Update to a version newer than 1.8.6.
What an attacker can do
Modify data in the plugin that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can alter signature data or plugin settings, potentially corrupting forms or workflows.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
