Lucene search

WordfenceCVE-2023-5251

HistoryOct 30, 2023 - 2:15 p.m.

CVE-2023-5251

2023-10-3014:15:09

CWE-862

Wordfence

web.nvd.nist.gov

wordpress

plugin

vulnerability

unauthorized modification

data loss

capability check

authenticated attackers

nvd

cve-2023-5251

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the ‘grid_plus_save_layout_callback’ and ‘grid_plus_delete_callback’ functions in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with subscriber privileges or above, to add, update or delete grid layout.

Affected configurations

Nvd

Vulners

Node

g5themegrid_plusRange≤1.3.2wordpress

VendorProductVersionCPE
g5themegrid_plus*cpe:2.3:a:g5theme:grid_plus:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
g5theme	grid_plus	*	cpe:2.3:a:g5theme:grid_plus::::::wordpress::*

CNA Affected

[
  {
    "vendor": "g5theme",
    "product": "Grid Plus – Unlimited grid layout",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.3.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/grid-plus/tags/1.3.2/core/ajax_be.php#L10

plugins.trac.wordpress.org/browser/grid-plus/tags/1.3.2/core/ajax_be.php#L69

www.wordfence.com/threat-intel/vulnerabilities/id/d2d34c84-473c-49f8-b55c-c869b5479974?source=cve

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

Related for CVE-2023-5251