CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9.
Explanation of Vulnerability in Simple Terms
Simple User Avatar versions up to 4.9 contain an authorization flaw that allows authenticated users to read sensitive information they should not access. The vulnerability requires a valid user account but no special privileges. An attacker with low-level access can view confidential data through the plugin's avatar functionality.
What an attacker can do
Read sensitive information accessible through the avatar system that should be restricted.
Potential impact on your site
Authenticated users can access confidential data beyond their permission level through the avatar feature.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
