CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the winston_disconnect() function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's API connection settings via the 'winston_disconnect' AJAX action.
Explanation of Vulnerability in Simple Terms
The HUMN-1 AI Website Scanner & Human Certification plugin versions 0.0.3 and earlier lack proper authorization checks. A logged-in user with low privileges can modify data they should not have access to. The vulnerability does not affect data confidentiality or system availability, only data integrity.
What an attacker can do
A low-privilege logged-in user can modify data they should not have permission to change.
Potential impact on your site
Unauthorized users with basic accounts can alter plugin data or settings, potentially affecting site content or functionality.
Conditions required to exploit
Attacker must have a low-privilege account on the site and network access to the plugin.
Key dates
External resources
Related vulnerabilities
