CVE-2023-2495

🗓️ 10 Jul 2023 12:40:36Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 41 Views🌐 WEB

The Greeklish-permalink WordPress plugin through 3.3 allows unauthenticated and low-privilege users to trigger functionality to change Post slugs

Reporter	Title	Published	Views	Family All 12
CNNVD	WordPress plugin Greeklish-permalink 安全漏洞	10 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-2495 Greeklish-permalink < 3.5 - Unauthenticated Post Slug Update	10 Jul 202312:40	–	cvelist
EUVD	EUVD-2023-33979	3 Oct 202520:07	–	euvd
NVD	CVE-2023-2495	10 Jul 202316:15	–	nvd
OSV	CVE-2023-2495	10 Jul 202316:15	–	osv
Patchstack	WordPress Greeklish-permalink Plugin <= 3.3 is vulnerable to Privilege Escalation	21 Jun 202300:00	–	patchstack
Prion	Authorization	10 Jul 202316:15	–	prion
RedhatCVE	CVE-2023-2495	23 May 202501:53	–	redhatcve
Vulnrichment	CVE-2023-2495 Greeklish-permalink < 3.5 - Unauthenticated Post Slug Update	10 Jul 202312:40	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (June 19, 2023 to June 25, 2023)	29 Jun 202313:24	–	wordfence

NVD

Vulners

Node

greeklish-permalink_project greeklish-permalinkRange≤3.3wordpress

[
  {
    "vendor": "Unknown",
    "product": "Greeklish-permalink",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "3.5"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/45878983-7e9b-49c2-8f99-4c28aab24f09

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Unauthenticated/low-privilege can trigger the cyrtrans_ajax_old AJAX action to change post slugs, enabling CSRF-like exploitation.

21 Nov 2024 07:58Current

4.9Medium risk

Vulners AI Score4.9

CVSS 3.14.3

EPSS0.00073

SSVC