CVE-2023-0335 WP Shamsi <= 4.3.3 - Subscriber+ Attachment Deletion

2023-03-2715:37:21

WPScan

www.cve.org

cve-2023-0335

wordpress

plugin

csrf

access control

vulnerabilities

attachment

deletion

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

20.0%

JSON

The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WP Shamsi",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "4.3.3"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]