CyberRota Analysis
AI-GeneratedThe WP Business Intelligence Lite plugin for WordPress is vulnerable to an authorization bypass, allowing authenticated users with Subscriber-level access and above to modify stored SQL queries. This flaw can lead to privilege escalation and arbitrary SQL execution when the altered queries are accessed by an administrator. WordPress site administrators using this plugin should prioritize patching to mitigate the risk of unauthorized data manipulation and potential system compromise.
Original NVD Description
The WP Business Intelligence Lite plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify stored SQL queries, which can lead to privilege escalation via arbitrary SQL execution when the modified query is viewed by an administrator.