CVE-2023-0402

The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete post meta information and reset network access tokens.

• CWE-862

• https://plugins.trac.wordpress.org/browser/social-warfare/trunk/lib/options/SWP_Options_Page.php?rev=2364155#L923Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2844092%40social-warfare&new=2844092%40social-warfare&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc4ba2c-32eb-46c5-bb40-7c0150fc1ca4?source=cve
• https://plugins.trac.wordpress.org/browser/social-warfare/trunk/lib/options/SWP_Options_Page.php?rev=2364155#L923Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2844092%40social-warfare&new=2844092%40social-warfare&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc4ba2c-32eb-46c5-bb40-7c0150fc1ca4Third Party Advisory

Published

Jan 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-0396A malicious / defective bluetooth controller can cause buffe…6.8
• CVE-2023-0397A malicious / defect bluetooth controller can cause a Denial…6.5
• CVE-2023-0398Cross-Site Request Forgery (CSRF) in GitHub repository modob…6.5
• CVE-2023-0399The Image Over Image For WPBakery Page Builder WordPress plu…5.4
• CVE-2023-0400 The protection bypass vulnerability in DLP for Windows 11.9…8.2
• CVE-2023-0401A NULL pointer can be dereferenced when signatures are being…7.5
• CVE-2023-0403The Social Warfare plugin for WordPress is vulnerable to Cro…5.4
• CVE-2023-0404The Events Made Easy plugin for WordPress is vulnerable to a…5.4
• CVE-2023-0405The GPT AI Power: Content Writer & ChatGPT & Image Generator…4.3
• CVE-2023-0406Cross-Site Request Forgery (CSRF) in GitHub repository modob…4.3
• CVE-2023-0410Cross-site Scripting (XSS) - Generic in GitHub repository bu…6.1
• CVE-2023-0411Excessive loops in multiple dissectors in Wireshark 4.0.0 to…6.5