CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in PluginEver WP Content Pilot wp-content-pilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Content Pilot: from n/a through <= 2.1.7.
Explanation of Vulnerability in Simple Terms
WP Content Pilot versions 2.1.7 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify or disable site functionality. An attacker with a basic user account can perform actions they should not be permitted to do. Update to a version newer than 2.1.7 to resolve this issue.
What an attacker can do
Modify or disable site features without proper permission as a low-privilege authenticated user.
Potential impact on your site
Unauthorized users can alter plugin settings or disable features, potentially disrupting site operations or content integrity.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges (e.g., Subscriber or Contributor role).
Key dates
External resources
Related vulnerabilities
