Marco WotschkaPATCHSTACK:27229918A88E5B6ED929D96B05893819WordPress Wicked Folders Plugin <= 2.18.16 is vulnerable to Broken Access Control
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
AI Score
Confidence
Low
Software
Wicked Folders
Type
Plugin
Vulnerable versions
<= 2.18.16
Fixed in
2.18.17
OWASP Top 10
A5: Broken Access Control
Classification
Broken Access Control
CVE
CVE-2023-0717
Patch priority
Medium
CVSS severity
Medium (5.4)
Developer
Claim ownership
PSID
db3e0ac8c3e4
Credits
Marco Wotschka
Required privilege
Subscriber
Published
8 February, 2023
Vulnerability details Vulnerability details
Expand full details Have additional information or questions about this entry? Let us know.
Solution
We advise to mitigate or resolve the vulnerability immediately.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| wicked_plugins | wicked_folders | * | cpe:2.3:a:wicked_plugins:wicked_folders:*:*:*:*:*:*:*:* |
References
plugins.trac.wordpress.org/browser/wicked-folders/tags/2.18.16/lib/class-wicked-folders-ajax.php
wordpress.org/plugins/wicked-folders/#developers
www.cve.org/CVERecord?id=CVE-2023-0717
www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wicked-folders/wicked-folders-21816-missing-authorization-via-ajax-delete-folder
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
AI Score
Confidence
Low