CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Marco Milesi WP Attachments wp-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attachments: from n/a through <= 5.2.
Explanation of Vulnerability in Simple Terms
WP Attachments versions 5.2 and earlier lack proper authorization checks, allowing authenticated users to modify or delete attachments they should not have access to. An attacker with a low-privilege account can alter the integrity of file uploads or remove attachments belonging to other users or posts. Update to a version newer than 5.2 to resolve this issue.
What an attacker can do
Modify or delete attachments belonging to other users or posts without proper permission.
Potential impact on your site
Unauthorized users can corrupt, alter, or remove file attachments across your site, affecting content integrity.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
