CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.5.
Explanation of Vulnerability in Simple Terms
WP-CRM System versions 3.4.5 and earlier lack proper authorization checks, allowing authenticated users to read and modify data they should not have access to. An attacker with a low-privilege account can view or alter sensitive information belonging to other users or the system. No user interaction is required. Update to a version newer than 3.4.5.
What an attacker can do
Read and modify data belonging to other users or the system without proper authorization.
Potential impact on your site
Any authenticated user can access or change CRM data they shouldn't, risking data breach and integrity loss.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
