Impact Analysis

An attacker with Subscriber-level access or above can reset AWeber logs, potentially disrupting tracking or auditing of email marketing activities, which may lead to loss of important log data and hinder incident investigation or monitoring.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Contact Form 7 AWeber Extension plugin for WordPress, where a missing capability check on the 'wp_ajax_aweber_logreset' AJAX endpoint allows authenticated users with Subscriber-level access or higher to reset the AWeber logs without proper authorization.

Useful 0 Not Useful 0