CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in kutsy AJAX Hits Counter + Popular Posts Widget ajax-hits-counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Hits Counter + Popular Posts Widget: from n/a through <= 0.10.210305.
Explanation of Vulnerability in Simple Terms
The AJAX Hits Counter + Popular Posts Widget plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify data they should not have access to. An attacker with a basic user account can alter widget settings or counter data, potentially disrupting site functionality or displaying false information to visitors.
What an attacker can do
Modify widget settings or counter data without proper authorization.
Potential impact on your site
Unauthorized users can alter hit counters or widget configuration, causing incorrect statistics or broken widget display.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., subscriber or contributor role) on the site.
Key dates
External resources
Related vulnerabilities
