Wds Mcp Content Manager
Monthly
Missing authorization checks in the WordPress plugin WDS MCP Content Manager (versions up to and including 3.10.4) let an authenticated Contributor-level user invoke functionality that should be reserved for higher-privileged roles, enabling limited unauthorized modification of plugin-managed content and settings. Exploitation requires only a Contributor account - a role that is trivially obtained on multi-author blogs and sites with open registration - needs no user interaction, and is reachable over the network, but the resulting impact is confined to a low-integrity change with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the 'Authentication Bypass' tag is somewhat overstated: this is an authenticated privilege/authorization gap, making it a low-to-moderate priority issue rather than a critical one.
Missing authorization checks in the WordPress plugin WDS MCP Content Manager (versions up to and including 3.10.4) let an authenticated Contributor-level user invoke functionality that should be reserved for higher-privileged roles, enabling limited unauthorized modification of plugin-managed content and settings. Exploitation requires only a Contributor account - a role that is trivially obtained on multi-author blogs and sites with open registration - needs no user interaction, and is reachable over the network, but the resulting impact is confined to a low-integrity change with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and the 'Authentication Bypass' tag is somewhat overstated: this is an authenticated privilege/authorization gap, making it a low-to-moderate priority issue rather than a critical one.