CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gain full admin privileges.
Explanation of Vulnerability in Simple Terms
The aapanel WP Toolkit versions 1.0 through 1.1 lack proper authorization checks, allowing authenticated users with low privileges to perform administrative actions they should not have access to. An attacker with a low-privilege account can read, modify, or delete sensitive data and disrupt site operations. Update to a version newer than 1.1 as soon as a patch is available.
What an attacker can do
Read, modify, or delete site data and settings without proper authorization.
Potential impact on your site
Low-privilege users can perform admin-level actions, compromising data integrity and site availability.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
