CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.4.
Explanation of Vulnerability in Simple Terms
The GDPR CCPA Compliance Support plugin through version 2.7.4 fails to properly check user permissions before allowing modifications to compliance settings. A logged-in user with low privileges can change critical GDPR/CCPA configuration without authorization, potentially disabling consent tracking or altering data handling policies. Site administrators should update immediately to prevent unauthorized compliance setting changes.
What an attacker can do
Modify GDPR/CCPA compliance settings without proper authorization.
Potential impact on your site
Compliance settings can be altered by unauthorized users, risking regulatory violations and data handling policy changes.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
