CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
What the vulnerability does
Missing Authorization vulnerability in wp-configurator WP Configurator Pro wp-configurator-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Configurator Pro: from n/a through <= 3.7.9.
Explanation of Vulnerability in Simple Terms
WP Configurator Pro versions 3.7.9 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify site settings and cause service disruptions. An attacker with a basic user account can alter configuration without permission, potentially affecting site availability and integrity. Update to a version newer than 3.7.9 to resolve this issue.
What an attacker can do
Modify site configuration and disrupt service availability with a low-privilege user account.
Potential impact on your site
Unauthorized users can change critical settings, degrade site performance, or cause downtime without admin approval.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site; no special interaction required.
Key dates
External resources
Related vulnerabilities
