CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Meta and Date Remover: from n/a through 2.3.6.
Explanation of Vulnerability in Simple Terms
WP Meta and Date Remover does not properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read metadata that should be restricted to administrators. The vulnerability affects versions up to 2.3.6. Update to a version newer than 2.3.6 to resolve this issue.
What an attacker can do
Read sensitive metadata that should be restricted to site administrators.
Potential impact on your site
Unauthorized users can access private metadata, potentially exposing sensitive site configuration or user data.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
