CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through <= 1.0.9.
Explanation of Vulnerability in Simple Terms
Watcher for Elementor versions 1.0.9 and earlier lack proper authorization checks, allowing authenticated users to modify or disable site functionality without appropriate permissions. An attacker with low-level access can alter plugin settings or disable monitoring features. Site administrators should update to a version newer than 1.0.9 to restore proper access controls.
What an attacker can do
Modify plugin settings or disable monitoring features without proper authorization.
Potential impact on your site
Unauthorized users can alter Watcher settings, disable monitoring, or degrade site integrity controls.
Conditions required to exploit
Attacker must have a low-level user account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
