CVE-2023-41133

CVE-2023-41133 is a WordPress plugin vulnerability in Secure Admin IP (versions

CVE-2023-41649

CVE-2023-41649 affects the WordPress plugin Ovic Product Bundle (versions up to 1.1.2). The issue is a Missing Authorization / Broken Access Control vulnerability that allows unauthenticated users to exploit misconfigured access controls. Across connected records, there is no published patch vers...

CVE-2023-41130

CVE-2023-41130 concerns the WordPress plugin Premmerce User Roles (Premmerce) where a missing authorization check in role-management functions leads to a Broken Access Control vulnerability. Affected versions are

CVE-2023-40334

CVE-2023-40334 affects the HUSKY – Products Filter for WooCommerce (formerly WOOF) WordPress plugin. Affected versions are

CVE-2023-39305

CVE-2023-39305 affects the WordPress plugin Yet Another Stars Rating (YASR) up to version 3.4.3, with a Missing Authorization / Broken Access Control issue occurring via the plugin’s init flow. This allows unauthenticated attackers to perform unauthorized actions (e.g., modifying data) on affecte...

CVE-2023-39920

CVE-2023-39920 affects the WordPress plugin Redirection for Contact Form 7 (wpcf7-redirect) up to version 2.9.2. The vulnerability is a Missing Authorization / Broken Access Control issue that allows exploitation due to incorrectly configured access levels, with unauthenticated access typically c...

CVE-2023-38483

CVE-2023-38483 — WordPress Instant CSS : A missing authorization vulnerability (Broken Access Control) in Instant CSS, affecting versions up to 1.1.4. The issue arises from missing authorization checks, enabling exploitation via AJAX actions. Patch available in version 1.1.5. CVSS v3.1 base score...

CVE-2023-38514

CVE-2023-38514 concerns a Missing Authorization vulnerability in the WordPress plugin Social Share Icons & Social Share Buttons , affecting versions up to 3.5.7. Multiple connected sources describe a broken access-control/unauthorized action scenario, caused by a missing authorization check in th...

CVE-2023-33998

CVE-2023-33998 affects the WordPress plugin Easy Social Icons (vulnerable:

CVE-2023-23472

CVE-2023-23472 affects IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7). An authenticated user could obtain sensitive information that could aid further attacks. The vulnerability is described in IBM’s bulletin as an information-disclosure issue with a CVSS v3.1 base sc...

CVE-2023-41953

CVE-2023-41953 concerns the WordPress plugin ProfilePress (Membership Team) up to version 4.13.1, where a Missing Authorization vulnerability exists. The connected PT-2023-8991 document attributes the issue to a flaw in the admin_notice() path that enables a CSRF attack due to incorrect nonce val...

CVE-2023-48277

CVE-2023-48277 affects the WordPress plugin Super Progressive Web Apps (up to version 2.2.21). The vulnerability is a Broken Access Control caused by missing authorization in the newsletter submission AJAX path, allowing unauthenticated users to subscribe to the plugin author’s newsletter. The ve...

CVE-2023-22701

CVE-2023-22701 affects WordPress Ebook Store plugin (≤ 5.775). The root cause is Missing Authorization / Broken Access Control allowing unauthenticated access to ebook_store_export_orders, potentially exposing order data. NVD CVSSv3.1 base score is 9.8 (CRITICAL); patch notes indicate fix in v5.7...

CVE-2023-25714

CVE-2023-25714 — WordPress Quick Paypal Payments plugin : A Missing Authorization (Broken Access Control) vulnerability in Quick Paypal Payments (versions

CVE-2023-30870

CVE-2023-30870: Vulnerability in the WordPress plugin Sharkdropship for AliExpress Dropship and Affiliate (versions

CVE-2023-32117

CVE-2023-32117 affects the WordPress plugin Integrate Google Drive (versions n/a–1.1.99). The root cause is Missing Authorization due to missing capability checks on REST API endpoints, enabling unauthenticated attackers to perform operations (move files, create folders, copy details, etc.). The ...

CVE-2023-32299

CVE-2023-32299 affects the WordPress plugin Ni WooCommerce Sales Report (Ni WooCommerce Sales Report) up to version 3.7.3, due to Missing Authorization / Broken Access Control. Attackers with subscriber-level privileges could exploit an improperly enforced access control to view sales data. The v...

CVE-2023-47756

CVE-2023-47756 is a Missing Authorization (Broken Access Control) vulnerability in the Welcome Email Editor WordPress plugin. Affected versions are

CVE-2023-47760

CVE-2023-47760 affects WordPress WPDeveloper Essential Blocks for Gutenberg. The vulnerability is a Missing Authorization/Broken Access Control in Essential Blocks for Gutenberg versions

CVE-2023-47762

CVE-2023-47762 affects WordPress BetterDocs plugin up to version 2.5.2, due to Missing Authorization via AJAX actions. Impact: unauthorized modification of documents for authenticated users with subscriber+ privileges (per Patchstack). Mitigation: upgrade to version 2.5.3 or later where fix is ap...