CVE-2023-0336 OoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment Deletion

2023-03-2715:37:38

WPScan

www.cve.org

ooohboi steroids

elementor

wordpress

csrf

access control

attachment deletion

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

20.0%

JSON

The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "OoohBoi Steroids for Elementor",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.1.5"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]