CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and ajax_update_export_code() functions in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete arbitrary WordPress options which can cause a denial of service.
Explanation of Vulnerability in Simple Terms
My WP Translate versions 1.1 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify or delete site data. An attacker with a basic user account can perform actions they should not have permission to execute. Update to a version newer than 1.1 to resolve this issue.
What an attacker can do
Modify or delete site data without proper authorization.
Potential impact on your site
Any registered user can alter or remove content they shouldn't access, risking data loss and site integrity.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
Related vulnerabilities
