CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.
Explanation of Vulnerability in Simple Terms
Demo Importer Plus through version 2.0.8 lacks proper authorization checks, allowing authenticated users with low privileges to modify site data. An attacker with a basic user account can perform actions they should not be permitted to execute. The vulnerability affects the plugin's core functionality and requires an active user session to exploit.
What an attacker can do
Modify site data or settings that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can alter site content or configuration, potentially disrupting site integrity or exposing sensitive settings.
Conditions required to exploit
Attacker must have a low-privilege user account on the site and be logged in.
Key dates
External resources
