CVE-2023-23492

2023-01-2019:15:18

CWE-89

tenable

web.nvd.nist.gov

cve-2023-23492

wordpress plugin

sql injection

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.059

Percentile

93.6%

JSON

The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the ‘ID’ parameter of its ‘lwp_forgot_password’ action.

Affected configurations

Nvd

Node

idehweblogin_with_phone_numberRange<1.4.2wordpress

VendorProductVersionCPE
idehweblogin_with_phone_number*cpe:2.3:a:idehweb:login_with_phone_number:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
idehweb	login_with_phone_number	*	cpe:2.3:a:idehweb:login_with_phone_number::::::wordpress::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Login with Phone Number WordPress Plugin",
    "versions": [
      {
        "version": "< 1.4.2",
        "status": "affected"
      }
    ]
  }
]