PT-2023-17332 · WordPress · Getwid

Ram + 1 · Published 2023-06-09 · Updated 2024-11-25 · CVE-2023-1910

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Getwid – Gutenberg Blocks plugin for WordPress versions up to, and including, 1.8.3

Description The issue allows unauthorized modification of data due to an insufficient capability check on the get remote templates function. This makes it possible for authenticated attackers with subscriber-level permissions or above to flush the remote template cache. Cached template information can also be accessed via this endpoint, but it is not considered sensitive as it is publicly accessible from the developer's site.

Recommendations For versions up to, and including, 1.8.3, update to a version higher than 1.8.3 to resolve the issue. As a temporary workaround, consider restricting access to the get remote templates function to prevent unauthorized modification of data.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2023-1910

Affected Products

Getwid

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-1910 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1910 · Vendor Advisory
• https://t.me/cibsecurity/65090 · Telegram Post
• https://plugins.trac.wordpress.org/browser/getwid/tags/1.8.3/includes/rest-api.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6cd64ab0-007b-4778-9d92-06e530638fad?source=cve · Note
• https://wordfence.com/blog/2023/06/credential-stealing-server-side-request-forgery-patched-in-getwid · Note