CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through <= 1.4.0.
Explanation of Vulnerability in Simple Terms
The SMS Contact Form 7 Notifications by ClickSend plugin for WordPress contains a missing authorization check that allows authenticated users with low privileges to modify data they should not have access to. An attacker with a basic user account can alter settings or information through the plugin without proper permission validation. Update to a version newer than 1.4.0 to resolve this issue.
What an attacker can do
Modify plugin settings or data without proper authorization as a low-privilege authenticated user.
Potential impact on your site
Unauthorized users can alter SMS notification settings or related data, potentially disrupting contact form functionality or exposing configuration.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
External resources
