CVE-2023-0889

Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74e	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:metagauss:themeflection_numbers:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2023-04-17 13:15

Updated : 2023-11-07 04:01

NVD link : CVE-2023-0889

Mitre link : CVE-2023-0889

CVE.ORG link : CVE-2023-0889

JSON object : View

Products Affected

metagauss

themeflection_numbers

CWE

No CWE.

{"id": "CVE-2023-0889", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-04-17T13:15:37.997", "references": [{"url": "https://wpscan.com/vulnerability/c39473a7-47fc-4bce-99ad-28d03f41e74e", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}], "vulnStatus": "Modified", "descriptions": [{"lang": "en", "value": "Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator"}], "lastModified": "2023-11-07T04:01:47.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:metagauss:themeflection_numbers:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "EE812581-9F84-4AEF-B911-7B353A217FFE", "versionEndExcluding": "2.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}

6.5 /10