CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through <= 4.9.3.
Explanation of Vulnerability in Simple Terms
Post Expirator through version 4.9.3 lacks proper authorization checks, allowing authenticated users with low privileges to access sensitive information they should not be able to view. An attacker with a basic WordPress account can read data restricted to higher-privilege roles. Update to a version newer than 4.9.3 to resolve this issue.
What an attacker can do
Read sensitive data restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can access confidential post or plugin data not intended for their role.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor).
Key dates
External resources
