CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a user to update the 'on_expire_default_to_role' meta through the 'save_extra_user_profile_fields' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Explanation of Vulnerability in Simple Terms
Expire Users versions 1.2.2 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read, modify, or delete sensitive data. An attacker with a basic user account can access functionality intended for administrators. This affects confidentiality, integrity, and availability of site data.
What an attacker can do
Read, modify, or delete sensitive data with only a low-privilege user account.
Potential impact on your site
Any registered user can access admin-level functions and compromise site data integrity.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
