Subscriber Broken Access Control in Reviewer <= 3.14.2

Executive Summary

This is a Subscriber Broken Access Control vulnerability in Reviewer plugin versions up to 3.14.2. It allows unauthorized users with subscriber-level access to perform actions they should not be able to, potentially modifying data or gaining elevated privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unprivileged users (e.g., subscribers) can perform actions requiring higher privileges in the Reviewer plugin. Review plugin files for missing authorization checks, authentication, or nonce token validations. Inspect server logs for unusual activity from low-privilege accounts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with subscriber access could exploit this to modify content, delete posts, or gain administrative control of the WordPress site. This could lead to website defacement, data loss, or further compromise of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unprivileged users to perform higher-privileged actions, which could lead to unauthorized data access or modification. For GDPR, this may violate principles of data protection and user rights. For HIPAA, it could compromise protected health information if exploited in healthcare-related WordPress sites. However, the specific impact depends on the data processed by the affected plugin.

Useful 0 Not Useful 0

Mitigation Strategies

Update Reviewer to a version higher than 3.14.2 to address the broken access control vulnerability. If an update is not available, consider disabling the plugin or restricting access to sensitive functions.

Useful 0 Not Useful 0