CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through <= 3.21.1.
Explanation of Vulnerability in Simple Terms
Ultimate Addons for WPBakery Page Builder versions up to 3.21.1 lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege WordPress account can change or delete pages and posts created by other users. Update to a version newer than 3.21.1 to resolve this issue.
What an attacker can do
Modify or delete pages and posts belonging to other users on the WordPress site.
Potential impact on your site
Any logged-in user can alter or remove your site's content without proper permission checks.
Conditions required to exploit
Attacker must have a valid WordPress user account with at least Subscriber or Contributor role.
Key dates
External resources
Related vulnerabilities
