CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0.
Explanation of Vulnerability in Simple Terms
WP Cost Estimation & Payment Forms Builder versions 10.3.0 and earlier lack proper authorization checks, allowing unauthenticated attackers to read sensitive data. An attacker can access the plugin without logging in or providing credentials. This affects all installations running the vulnerable version. Update immediately to a version newer than 10.3.0.
What an attacker can do
Read sensitive data from the plugin without authentication.
Potential impact on your site
Attackers can view confidential form data, payment information, or other sensitive content stored by the plugin.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
