CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.16.8.
Explanation of Vulnerability in Simple Terms
Paid Member Subscriptions versions 2.16.8 and earlier contain a denial-of-service vulnerability. An authenticated attacker with low privileges can trigger a condition that makes the site unavailable or unresponsive. The vulnerability requires network access and valid login credentials but no user interaction from the victim.
What an attacker can do
Make the site unavailable or unresponsive to legitimate users.
Potential impact on your site
Site downtime or performance degradation affecting all visitors until the attack stops or the plugin is patched.
Conditions required to exploit
Valid login credentials with low-level privileges; network access to the site.
Key dates
External resources
