CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.
Explanation of Vulnerability in Simple Terms
Author Avatars List/Block versions up to 2.1.25 fail to properly check user permissions before exposing avatar data. An unauthenticated attacker can read limited information about site users without authorization. The vulnerability requires no special setup or user interaction.
What an attacker can do
Read user avatar data and associated information without logging in.
Potential impact on your site
Unauthenticated visitors can enumerate and view user profile information that should be restricted.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
