CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.
Explanation of Vulnerability in Simple Terms
Fusion Builder versions up to 3.15.0 fail to properly check user permissions before allowing access to sensitive functions. A logged-in user with low privileges can read data they should not have access to, such as other users' information or private site content. Update to a version newer than 3.15.0 to fix this issue.
What an attacker can do
Read sensitive data like other users' information or private site content without proper authorization.
Potential impact on your site
Unauthorized users can access confidential information stored in your site, risking data breaches and privacy violations.
Conditions required to exploit
Attacker must have a low-privilege account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
