CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar Countdown Addon: from n/a through <= 1.4.15.
Explanation of Vulnerability in Simple Terms
The Events Calendar Countdown Addon for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify data they should not have access to. The vulnerability affects versions up to 1.4.15. An attacker with a basic user account can alter event countdown settings or related content without proper permission checks. Update to a version newer than 1.4.15 to resolve this issue.
What an attacker can do
Modify event countdown data or settings without proper authorization.
Potential impact on your site
Unauthorized users can alter countdown addon settings or event data, potentially disrupting event displays or misleading site visitors.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
