CVE-2023-0889
Last modified
CVE-2023-0889 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Metagauss | Themeflection Numbers | < 2.0.1 |
References
- https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74eExploit, Third Party Advisory
- https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74eExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-0889?
How severe is CVE-2023-0889?
How do I fix CVE-2023-0889?
Are you affected by CVE-2023-0889?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST