Mcp Content Manager Lite
Monthly
Broken access control in the MCP Content Manager Lite WordPress plugin (versions through 1.1.0) allows an authenticated attacker holding only a Subscriber-level account to modify content that should require higher privileges, with CVSS 6.5 reflecting a high integrity impact but no confidentiality or availability loss. Exploitation is network-remote, low-complexity, and requires no user interaction, but it is gated by the need for a valid low-privileged login (CVSS PR:L), making it most realistic on sites that allow open or self-service user registration; the plugin's niche install base further limits opportunistic abuse. No public exploit code or confirmed active exploitation was identified at time of analysis.
Broken access control in the MCP Content Manager Lite WordPress plugin (versions through 1.1.0) allows an authenticated attacker holding only a Subscriber-level account to modify content that should require higher privileges, with CVSS 6.5 reflecting a high integrity impact but no confidentiality or availability loss. Exploitation is network-remote, low-complexity, and requires no user interaction, but it is gated by the need for a valid low-privileged login (CVSS PR:L), making it most realistic on sites that allow open or self-service user registration; the plugin's niche install base further limits opportunistic abuse. No public exploit code or confirmed active exploitation was identified at time of analysis.