CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their user meta information in the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their user type to that of an administrator.
Explanation of Vulnerability in Simple Terms
Social Streams versions 1.0.1 and earlier contain a privilege escalation vulnerability. An authenticated user with low privileges can read sensitive data, modify site content, or disrupt service availability. The vulnerability requires network access and valid login credentials but no additional user interaction. Administrators should update to a version newer than 1.0.1 as soon as possible.
What an attacker can do
Read sensitive data, modify content, or disrupt service availability with a low-privilege account.
Potential impact on your site
Authenticated users can escalate privileges to access or modify restricted data and functionality.
Conditions required to exploit
Valid login credentials with low-level privileges; network access to the site.
Key dates
External resources
Related vulnerabilities
