CVE-2023-0441
Last modified
CVE-2023-0441 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.. EPSS estimates a 0.73% chance of exploitation in the next 30 days.
Description
The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Simplygallery | Simply Gallery Blocks With Lightbox | < 3.0.8 |
References
- https://wpscan.com/vulnerability/11703e49-c042-4eb6-9a5f-6e006e3725a0Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/11703e49-c042-4eb6-9a5f-6e006e3725a0Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-0441?
How severe is CVE-2023-0441?
How do I fix CVE-2023-0441?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-0435Excessive Attack Surface in GitHub repository pyload/pyload …9.8
- CVE-2023-0436The affected versions of MongoDB Atlas Kubernetes Operator m…7.5
- CVE-2023-0437When calling bson_utf8_validate on some inputs a loop with a…7.5
- CVE-2023-0438Cross-Site Request Forgery (CSRF) in GitHub repository modob…6.5
- CVE-2023-0439The NEX-Forms WordPress plugin before 8.4.4 does not escape …5.4
- CVE-2023-0440Observable Discrepancy in GitHub repository healthchecks/hea…5.3
- CVE-2023-0442The Loan Comparison WordPress plugin before 1.5.3 does not v…6.1
- CVE-2023-0443The AnyWhere Elementor WordPress plugin before 1.2.8 disclos…5.3
- CVE-2023-0444A privilege escalation vulnerability exists in Delta Electro…8.8
- CVE-2023-0446The My YouTube Channel plugin for WordPress is vulnerable to…5.5
- CVE-2023-0447The My YouTube Channel plugin for WordPress is vulnerable to…4.3
- CVE-2023-0448The WP Helper Lite WordPress plugin, in versions < 4.3, retu…6.1
Are you affected by CVE-2023-0441?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST