Anspress Question And Answer
Monthly
Broken Access Control in the AnsPress WordPress plugin version 4.4.4 allows authenticated subscriber-level users to perform high-integrity write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H) confirms low-privilege network exploitation with no user interaction required, making any WordPress site with open user registration a viable target. No active exploitation has been confirmed (not in CISA KEV), and no public POC is referenced in available data.
Broken Access Control in the AnsPress WordPress plugin version 4.4.4 allows authenticated subscriber-level users to perform high-integrity write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H) confirms low-privilege network exploitation with no user interaction required, making any WordPress site with open user registration a viable target. No active exploitation has been confirmed (not in CISA KEV), and no public POC is referenced in available data.