CVE-2023-0551 REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion

2023-08-1611:03:30

WPScan

www.cve.org

cve-2023-0551

rest api

miniprogram

plugin

subscriber

attachment

deletion

wordpress

authorisation

csrf

ajax

authenticated users

EPSS

0.001

Percentile

27.4%

JSON

The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "REST API TO MiniProgram",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "4.6.1"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d

EPSS

0.001

Percentile

27.4%

JSON

Related for CVELIST:CVE-2023-0551