CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in MyThemeShop WP Subscribe wp-subscribe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscribe: from n/a through <= 1.2.16.
Explanation of Vulnerability in Simple Terms
WP Subscribe versions 1.2.16 and earlier contain an authorization bypass that allows authenticated users to modify data they should not have access to. The vulnerability requires a valid WordPress account but no special privileges. An attacker with low-level access can alter subscription settings or related information without proper permission checks.
What an attacker can do
Modify subscription data or settings belonging to other users or the site.
Potential impact on your site
Unauthorized changes to subscription configurations, potentially affecting email lists or user data integrity.
Conditions required to exploit
Valid WordPress user account with low-level privileges; network access to the site.
Key dates
External resources
Related vulnerabilities
