Gratisfaction
Monthly
Missing authorization checks in the Gratisfaction WordPress plugin (versions up to and including 4.6.3) allow authenticated Subscriber-level attackers to bypass access controls, potentially leading to high confidentiality impact and limited integrity/availability impact. The flaw is network-reachable with low complexity (CVSS 7.6 HIGH, PR:L) and requires only a low-privileged account, which may be obtainable via open registration on sites using the plugin. No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization checks in the Gratisfaction WordPress plugin (versions up to and including 4.6.3) allow authenticated Subscriber-level attackers to bypass access controls, potentially leading to high confidentiality impact and limited integrity/availability impact. The flaw is network-reachable with low complexity (CVSS 7.6 HIGH, PR:L) and requires only a low-privileged account, which may be obtainable via open registration on sites using the plugin. No public exploit code or active exploitation has been identified at time of analysis.