Staff Training
Monthly
Broken access control in the Staff Training WordPress plugin (versions ≤ 1.0.7, by Solutioned) exposes protected plugin functionality to unauthenticated remote attackers, enabling unauthorized read, write, and limited availability impacts against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - one or more plugin-registered endpoints fail to verify caller capabilities before executing privileged operations. No public exploit code or active exploitation has been confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates extremely low exploitation complexity against any reachable WordPress site running the affected plugin.
Broken access control in the Staff Training WordPress plugin (versions ≤ 1.0.7, by Solutioned) exposes protected plugin functionality to unauthenticated remote attackers, enabling unauthorized read, write, and limited availability impacts against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - one or more plugin-registered endpoints fail to verify caller capabilities before executing privileged operations. No public exploit code or active exploitation has been confirmed at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates extremely low exploitation complexity against any reachable WordPress site running the affected plugin.