PT-2023-16555 · WordPress · Underconstruction

Alex Thomas + 2 · Published 2023-06-09 · Updated 2023-06-14 · CVE-2023-0831

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Under Construction plugin for WordPress versions up to and including 3.96

Description The issue arises from missing or incorrect nonce validation on the dismiss notice function, which is called via the admin action ucp dismiss notice action. This allows unauthenticated attackers to dismiss plugin notifications by tricking a site administrator into performing an action, such as clicking on a link, thereby facilitating a Cross-Site Request Forgery attack.

Recommendations For Under Construction plugin for WordPress versions up to and including 3.96, update to a version that includes proper nonce validation for the dismiss notice function to prevent Cross-Site Request Forgery attacks. As a temporary workaround, consider restricting access to the admin action ucp dismiss notice action to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-0831

Affected Products

Underconstruction

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-0831 · Security Note
• https://plugins.trac.wordpress.org/browser/under-construction-page/trunk/under-construction.php?rev=2848705#L901 · Patch
• https://osv.dev/vulnerability/CVE-2023-0831 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/031a1203-6b0d-453b-be8a-12e7f55cb401?source=cve · Note