Vulnerabilities > CVE-2021-4448 - Missing Authorization vulnerability in Kaswara Project Kaswara 3.0.1

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
kaswara-project
CWE-862
critical

Summary

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.

Vulnerable Configurations

Part Description Count
Application
Kaswara_Project
2

Common Weakness Enumeration (CWE)