PT-2023-16642 · WordPress · Inisev

Chloe Chamberland

·

Publicado

2023-07-28

·

Atualizado

2025-04-03

·

CVE-2023-0958

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Inisev WordPress plugins (affected versions not specified)
Description The issue allows authenticated attackers with minimal permissions to install select plugins due to a missing capability check on the handle installation function. This function is called via the inisev installation AJAX action. As a result, attackers with minimal permissions, such as subscribers, can install plugins on vulnerable sites.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-0958

Produtos afetados

Inisev