CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their capabilities to those of an administrator.
Explanation of Vulnerability in Simple Terms
Event List versions 2.0.4 and earlier contain a privilege management flaw that allows authenticated users with low-level access to perform actions restricted to higher-privilege roles. An attacker with a basic user account can read sensitive data, modify site content, or disrupt service without additional interaction. Update to a version newer than 2.0.4 immediately.
What an attacker can do
Read sensitive data, modify content, or disrupt the site using a low-privilege user account.
Potential impact on your site
Unauthorized users can access admin functions and modify or delete event data without proper authorization.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
