CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 16.8 via the wpmr_inspect_file() function due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Malcure Malware Shield versions 16.8 and earlier lack proper authorization checks, allowing authenticated users to access sensitive information they should not be able to view. An attacker with a low-privilege account can read confidential data without modifying or disrupting the system. Update to a version newer than 16.8 to resolve this issue.
What an attacker can do
Read sensitive data they don't have permission to access.
Potential impact on your site
Confidential information may be exposed to users with limited permissions.
Conditions required to exploit
Attacker must have a low-privilege user account on the system.
Key dates
External resources
Related vulnerabilities
