CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the plugin not properly restricting a claimed identity while authenticating with Facebook. This makes it possible for unauthenticated attackers to log in as other users, including administrators.
Explanation of Vulnerability in Simple Terms
The Brave Conversion Engine (PRO) versions 0.7.7 and earlier contain an authentication bypass vulnerability. An attacker can exploit weak or missing authentication controls to gain unauthorized access to the engine without valid credentials. This allows complete compromise of confidentiality, integrity, and availability. No user interaction or special privileges are required.
What an attacker can do
Gain unauthorized access to the Brave Conversion Engine and read, modify, or delete data without authentication.
Potential impact on your site
Complete compromise of the Brave Conversion Engine: attackers can access, modify, or destroy data without logging in.
Conditions required to exploit
Network access to the vulnerable Brave Conversion Engine instance; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
