CVE-2023-0336

2023-03-2716:15:08

CWE-862

CWE-352

[email protected]

web.nvd.nist.gov

ooohboi

steroids

elementor

wordpress

csrf

access control

vulnerabilities

attachment

delete

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

20.0%

JSON

The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.

Affected configurations

Nvd

Node

ooohboi_steroids_for_elementor_projectooohboi_steroids_for_elementorRange<2.1.5wordpress

VendorProductVersionCPE
ooohboi_steroids_for_elementor_projectooohboi_steroids_for_elementor*cpe:2.3:a:ooohboi_steroids_for_elementor_project:ooohboi_steroids_for_elementor:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
ooohboi_steroids_for_elementor_project	ooohboi_steroids_for_elementor	*	cpe:2.3:a:ooohboi_steroids_for_elementor_project:ooohboi_steroids_for_elementor::::::wordpress::*