1380 matches found
CVE-2023-35037
CVE-2023-35037 affects the WordPress Surfer plugin (surferseo): Broken access control in Surfer
CVE-2023-33324
CVE-2023-33324 is a Missing Authorization/Broken Access Control vulnerability in WordPress plugin Easy Captcha (versions up to 1.0). The issue arises from insufficient access checks, enabling unauthorized entities to perform restricted actions. The vulnerability affects Easy Captcha
CVE-2023-33215
CVE-2023-33215 affects the WordPress Taggbox widget/plugin, specifically versions
CVE-2023-37395
CVE-2023-37395 affects IBM Aspera Faspex 5.0.0–5.0.7, where a local user could obtain sensitive information due to improper encryption of certain data. The Red Hat and other security sources corroborate an information disclosure vulnerability in Faspex 5.x, with the IBM bulletin explicitly listin...
CVE-2023-48277
CVE-2023-48277 affects the WordPress plugin Super Progressive Web Apps (up to version 2.2.21). The vulnerability is a Broken Access Control caused by missing authorization in the newsletter submission AJAX path, allowing unauthenticated users to subscribe to the plugin author’s newsletter. The ve...
CVE-2023-22701
CVE-2023-22701 affects WordPress Ebook Store plugin (≤ 5.775). The root cause is Missing Authorization / Broken Access Control allowing unauthenticated access to ebook_store_export_orders, potentially exposing order data. NVD CVSSv3.1 base score is 9.8 (CRITICAL); patch notes indicate fix in v5.7...
CVE-2023-25455
CVE-2023-25455 is a Missing Authorization vulnerability in the miniOrange WordPress Social Login and Register plugin (Discord, Google, Twitter, LinkedIn) affecting versions up to 7.6.0. The issue allows unauthenticated actors to perform Arbitrary Content Deletion due to incorrectly configured acc...
CVE-2023-27428
CVE-2023-27428 affects WordPress WP users media plugin, vulnerable ≤ 4.2.3 due to missing authorization/broken access control. Technical details in connected docs cite a Missing Authorization/CSRF issue on wpusme_save_settings, enabling unauthorized/settings modification for affected users. No pa...
CVE-2023-28689
CVE-2023-28689 : WordPress plugin JS Job Manager (versions
CVE-2023-29239
LuckyWP Scripts Control (WordPress plugin)
CVE-2023-30870
CVE-2023-30870: Vulnerability in the WordPress plugin Sharkdropship for AliExpress Dropship and Affiliate (versions
CVE-2023-32117
CVE-2023-32117 affects the WordPress plugin Integrate Google Drive (versions n/a–1.1.99). The root cause is Missing Authorization due to missing capability checks on REST API endpoints, enabling unauthenticated attackers to perform operations (move files, create folders, copy details, etc.). The ...
CVE-2023-32299
CVE-2023-32299 affects the WordPress plugin Ni WooCommerce Sales Report (Ni WooCommerce Sales Report) up to version 3.7.3, due to Missing Authorization / Broken Access Control. Attackers with subscriber-level privileges could exploit an improperly enforced access control to view sales data. The v...
CVE-2023-47698
CVE-2023-47698 affects WordPress plugin Japanized For WooCommerce (woocommerce-for-japan) ≤ 2.6.4, due to Missing/Incorrectly configured Authorization (Broken Access Control). Unauthenticated attackers could exploit this; CVSS v3.1 base score 8.6 (HIGH). Patch 2.6.5 fixes the issue. remediation: ...
CVE-2023-47756
CVE-2023-47756 is a Missing Authorization (Broken Access Control) vulnerability in the Welcome Email Editor WordPress plugin. Affected versions are
CVE-2023-47760
CVE-2023-47760 affects WordPress WPDeveloper Essential Blocks for Gutenberg. The vulnerability is a Missing Authorization/Broken Access Control in Essential Blocks for Gutenberg versions
CVE-2023-47761
CVE-2023-47761 affects the WordPress plugin Simple 301 Redirects by BetterLinks. Public details confirm a Missing Authorization / Broken Access Control vulnerability in versions up to and including 2.0.7, allowing unauthorized access under configured access control levels. The vulnerability arise...
CVE-2023-47762
CVE-2023-47762 affects WordPress BetterDocs plugin up to version 2.5.2, due to Missing Authorization via AJAX actions. Impact: unauthorized modification of documents for authenticated users with subscriber+ privileges (per Patchstack). Mitigation: upgrade to version 2.5.3 or later where fix is ap...