PT-2023-18341 · WordPress · Badgeos

Alex Thomas

·

Publicado

2023-08-31

·

Atualizado

2023-09-01

·

CVE-2023-2173

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions BadgeOS plugin for WordPress versions up to, and including, 3.7.1.6
Description The issue is due to improper validation and authorization checks within the (badgeos delete step ajax handler), (badgeos delete award step ajax handler), (badgeos delete deduct step ajax handler), and (badgeos delete rank req step ajax handler) functions. This allows authenticated attackers with subscriber-level permissions and above to delete arbitrary posts.
Recommendations For BadgeOS plugin for WordPress versions up to, and including, 3.7.1.6, consider disabling the (badgeos delete step ajax handler), (badgeos delete award step ajax handler), (badgeos delete deduct step ajax handler), and (badgeos delete rank req step ajax handler) functions until a patch is available to prevent exploitation.

Correção

IDOR

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-2173

Produtos afetados

Badgeos