CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.
Explanation of Vulnerability in Simple Terms
Testimonial Slider through version 2.0.15 lacks proper authorization checks, allowing authenticated users to read sensitive data they should not access. An attacker with a low-privilege account can retrieve confidential information without additional interaction. Site administrators should update to a version newer than 2.0.15 to restrict unauthorized data access.
What an attacker can do
Read sensitive data belonging to other users or the site without permission.
Potential impact on your site
Authenticated users can access confidential information beyond their role permissions, risking data exposure.
Conditions required to exploit
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
External resources
