CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through <= 9.5.7.
Explanation of Vulnerability in Simple Terms
Really Simple SSL versions 9.5.7 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify site settings they should not have access to. The vulnerability requires a valid WordPress account but does not require administrator rights. Integrity of site configuration is at risk.
What an attacker can do
Modify SSL or security settings on the site without having administrator privileges.
Potential impact on your site
Unauthorized users could alter SSL configuration, potentially weakening site security or redirecting traffic.
Conditions required to exploit
Attacker must have a valid low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
