CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.
Explanation of Vulnerability in Simple Terms
Crowdsignal Forms versions 1.7.2 and earlier lack proper authorization checks, allowing high-privilege users to modify or disable certain site functions. The vulnerability requires administrator-level access and does not expose sensitive data. Sites should update to a version newer than 1.7.2 when available.
What an attacker can do
Modify or disable site functionality if they have administrator access.
Potential impact on your site
Administrators with malicious intent could alter form behavior or disable features without proper authorization controls.
Conditions required to exploit
Attacker must have administrator-level privileges on the site.
Key dates
External resources
Related vulnerabilities
