CVE-2023-7198 WPDashboardNotes < 1.0.11 - Unauthorised Deletion of Private Notes

2024-02-2708:30:27

WPScan

github.com

wp dashboard notes

wordpress plugin

vulnerability

insecure direct object references

idor

authenticated users

data privacy

AI Score

6.3

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses a significant security risk as it violates the principle of least privilege and compromises the integrity and privacy of user data.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:wp-dashboard-notes:wp_dashboard_notes:*:*:*:*:*:*:*:*"
    ],
    "vendor": "wp-dashboard-notes",
    "product": "wp_dashboard_notes",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.0.11",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]