Wp Admin Audit
Monthly
Missing authorization checks in the WordPress plugin WP Admin Audit (Brandtoss) through version 1.2.17 let an already-authenticated low-privilege user reach plugin functionality and audit data they are not permitted to see. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) the attacker must hold a valid account on the target site, so the flaw is not anonymously exploitable, and the impact is limited to confidentiality with no integrity or availability effect. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; severity is moderate (vendor-reported 4.3), with the main risk being disclosure of audit-log information to subscribers or other low-privilege accounts.
Missing authorization checks in the WordPress plugin WP Admin Audit (Brandtoss) through version 1.2.17 let an already-authenticated low-privilege user reach plugin functionality and audit data they are not permitted to see. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) the attacker must hold a valid account on the target site, so the flaw is not anonymously exploitable, and the impact is limited to confidentiality with no integrity or availability effect. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; severity is moderate (vendor-reported 4.3), with the main risk being disclosure of audit-log information to subscribers or other low-privilege accounts.