Allable Connector
Monthly
Broken access control in the WordPress plugin AllAble Connector (versions up to and including 0.13.4) lets an authenticated attacker holding only a low-privilege Subscriber account invoke functionality that should be restricted to higher-privileged users, resulting in partial loss of confidentiality and integrity (CVSS 5.4, CWE-862). Exploitation requires the attacker to already hold a Subscriber-level or higher account on a site running the vulnerable plugin - a bar that self-service registration on many WordPress sites meets - but needs no user interaction and is reachable remotely, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The flaw was reported by Patchstack; no public exploit code has been identified and there is no indication of confirmed active exploitation (not in CISA KEV), and the exact vulnerable endpoint has not been disclosed in the available data.
Broken access control in the WordPress plugin AllAble Connector (versions up to and including 0.13.4) lets an authenticated attacker holding only a low-privilege Subscriber account invoke functionality that should be restricted to higher-privileged users, resulting in partial loss of confidentiality and integrity (CVSS 5.4, CWE-862). Exploitation requires the attacker to already hold a Subscriber-level or higher account on a site running the vulnerable plugin - a bar that self-service registration on many WordPress sites meets - but needs no user interaction and is reachable remotely, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The flaw was reported by Patchstack; no public exploit code has been identified and there is no indication of confirmed active exploitation (not in CISA KEV), and the exact vulnerable endpoint has not been disclosed in the available data.