PT-2023-32233 · WordPress · Wp Mail Log

Dc11 · Publicado 2023-12-26 · Atualizado 2024-09-25 · CVE-2023-5644

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP Mail Log WordPress plugin versions prior to 1.1.3

Description The issue arises from incorrect authorization of REST API endpoints in the WP Mail Log WordPress plugin, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

Recommendations For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API endpoints to minimize the risk of exploitation.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-5644

Produtos afetados

Wp Mail Log

Referências · 7

• 🔥 https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e · Exploit
• https://t.me/cvenotify/96056 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-5644 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1739763258607739122 · Publicação no Twitter
• https://t.me/cvenotify/65150 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1739717111180820805 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5644 · Aviso do Fabricante