CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
What the vulnerability does
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality.
Explanation of Vulnerability in Simple Terms
The Block Bad Bots plugin for WordPress contains an authorization flaw that allows unauthenticated attackers to read sensitive configuration data and disrupt the site's availability. The vulnerability affects versions up to 11.58 and requires no special privileges or user interaction to exploit. Site administrators should update immediately to a patched version.
What an attacker can do
Read plugin configuration and cause temporary service disruption without authentication.
Potential impact on your site
Attackers can view bot-blocking settings and temporarily degrade site performance.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
