CVE-2023-6633
Last modified
CVE-2023-6633 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sidenotesproject | Side Notes | <= 2.0.0 |
References
- https://wpscan.com/vulnerability/eb983d82-b894-41c5-b51f-94d4bba3ba39/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/eb983d82-b894-41c5-b51f-94d4bba3ba39/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-6633?
How severe is CVE-2023-6633?
How do I fix CVE-2023-6633?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-6626The Product Enquiry for WooCommerce WordPress plugin before …4.8
- CVE-2023-6627The WP Go Maps (formerly WP Google Maps) WordPress plugin be…6.1
- CVE-2023-6629The POST SMTP Mailer – Email log, Delivery Failure Notificat…6.1
- CVE-2023-6630The Contact Form 7 – Dynamic Text Extension plugin for WordP…4.3
- CVE-2023-6631PowerSYSTEM Center versions 2020 Update 16 and prior contain…7.8
- CVE-2023-6632The Happy Addons for Elementor plugin for WordPress is vulne…6.1
- CVE-2023-6634The LearnPress plugin for WordPress is vulnerable to Command…9.8
- CVE-2023-6635The EditorsKit plugin for WordPress is vulnerable to arbitra…7.2
- CVE-2023-6636The Greenshift – animation and page builder blocks plugin fo…7.2
- CVE-2023-6637The CAOS | Host Google Analytics Locally plugin for WordPres…5.3
- CVE-2023-6638The GTG Product Feed for Shopping plugin for WordPress is vu…5.3
- CVE-2023-6640Malformed S2 Nonce Get Command Class packets can be sent to …6.5
Are you affected by CVE-2023-6633?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST