PT-2023-16356 · WordPress · Rest Api To Miniprogram

Lana Codes · Published 2023-08-16 · Updated 2023-08-22 · CVE-2023-0551

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions REST API TO MiniProgram WordPress plugin versions through 4.6.1

Description The issue concerns a lack of authorization and CSRF checks in an AJAX action within the REST API TO MiniProgram WordPress plugin. This allows any authenticated users, such as subscribers, to call and delete arbitrary attachments.

Recommendations For versions through 4.6.1, consider disabling the AJAX action related to attachment deletion until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the plugin's features that involve attachment management until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2023-0551

Affected Products

Rest Api To Miniprogram

References · 8

• 🔥 https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0551 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0551 · Vendor Advisory
• https://t.me/cvenotify/57086 · Telegram Post
• https://twitter.com/CVEnew/status/1691770036640219339 · Twitter Post
• https://t.me/cibsecurity/68641 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1691823214505156932 · Twitter Post
• https://t.me/cvenotify/56600 · Telegram Post