CVE-2023-6029
Last modified
CVE-2023-6029 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections.. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Spider-Themes | Eazydocs | < 2.3.6 |
References
- https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597eExploit, Third Party Advisory
- https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597eExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-6029?
How severe is CVE-2023-6029?
How do I fix CVE-2023-6029?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-6021LFI in Ray's log API endpoint allows attackers to read any f…7.5
- CVE-2023-6022Cross-Site Request Forgery (CSRF) in GitHub repository prefe…8.8
- CVE-2023-6023An attacker can read any file on the filesystem on the serve…7.5
- CVE-2023-6026A Path traversal vulnerability has been reported in elijaa/p…9.1
- CVE-2023-6027A critical flaw has been identified in elijaa/phpmemcachedad…5.4
- CVE-2023-6028A reflected cross-site scripting (XSS) vulnerability exists …6.1
- CVE-2023-6030The LogDash Activity Log WordPress plugin before 1.1.4 hooks…5.4
- CVE-2023-6032 A CWE-22: Improper Limitation of a Pathname to a Restricted…5.3
- CVE-2023-6033Improper neutralization of input in Jira integration configu…5.4
- CVE-2023-6034Rejected reason: Accidental request.
- CVE-2023-6035The EazyDocs WordPress plugin before 2.3.4 does not properly…8.8
- CVE-2023-6036The Web3 WordPress plugin before 3.0.0 is vulnerable to an a…9.8
Are you affected by CVE-2023-6029?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST