CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Fahad Mahmood RSS Feed Widget rss-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RSS Feed Widget: from n/a through <= 3.0.2.
Explanation of Vulnerability in Simple Terms
RSS Feed Widget through version 3.0.2 lacks proper authorization checks, allowing authenticated users with low privileges to modify or disable feed functionality. An attacker can alter feed settings or disrupt feed availability without proper permission validation. The vulnerability requires a valid user account but no special privileges.
What an attacker can do
Modify or disable RSS feed settings and availability without proper authorization.
Potential impact on your site
Authenticated users can tamper with RSS feed configuration, potentially disrupting feed delivery or altering feed content visibility.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
