Websamurai
Monthly
Missing authorization in the WebSamurai WordPress plugin (versions up to and including 1.0.7) lets an attacker who already holds a low-privilege authenticated account on the target site invoke a plugin action that lacks a proper capability check, altering site data without permission. Because the CVSS vector is PR:L, exploitation requires a valid low-privilege WordPress session rather than being unauthenticated, and the assessed impact is integrity-only (C:N/I:H/A:N) with no disclosure or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, so real-world exposure is concentrated on sites that permit untrusted user registration or otherwise host low-trust accounts.
Missing authorization in the WebSamurai WordPress plugin (versions up to and including 1.0.7) lets an attacker who already holds a low-privilege authenticated account on the target site invoke a plugin action that lacks a proper capability check, altering site data without permission. Because the CVSS vector is PR:L, exploitation requires a valid low-privilege WordPress session rather than being unauthenticated, and the assessed impact is integrity-only (C:N/I:H/A:N) with no disclosure or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, so real-world exposure is concentrated on sites that permit untrusted user registration or otherwise host low-trust accounts.