CVE-2023-6966

2024-06-0602:15:52

[email protected]

web.nvd.nist.gov

cve-2023-6966

data access vulnerability

data modification vulnerability

data loss vulnerability

missing capability check

ajax functions

authenticated attackers

subscriber access

update billing details

retrieve bank details

reset plugin settings

lower-severity actions

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

6.5 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

19.4%

JSON

The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.5.20. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin’s settings, and update languages as well as other lower-severity actions.

Affected configurations

Vulners

Node

lvaudorethe_moneytizerRange≤9.5.20

CNA Affected

[
  {
    "vendor": "lvaudore",
    "product": "The Moneytizer",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "9.5.20",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]