PT-2023-30029 · WordPress · Ad Inserter

Marco Wotschka · Published 2023-10-18 · Updated 2023-10-25 · CVE-2023-4645

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ad Inserter for WordPress versions up to, and including, 2.7.30

Description The issue allows unauthenticated attackers to extract sensitive data such as post titles and slugs, including those of protected posts along with their passwords, usernames, available roles, and the plugin license key, provided the remote debugging option is enabled. The remote debugging option is disabled by default. This is achieved via the ai ajax function.

Recommendations For versions up to, and including, 2.7.30, consider disabling the ai ajax function until a patch is available. Additionally, ensure the remote debugging option remains disabled to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-4645

Affected Products

Ad Inserter

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-4645 · Security Note
• https://plugins.trac.wordpress.org/browser/ad-inserter/trunk/ad-inserter.php#L6529 · Patch
• https://osv.dev/vulnerability/CVE-2023-4645 · Vendor Advisory
• https://twitter.com/CVEnew/status/1714830282598101329 · Twitter Post
• https://t.me/cibsecurity/72546 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1714880294849851428 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&old=2922718%40ad-inserter%2Ftrunk · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/57b3eef3-e165-45ac-89d7-2a2a6529b310?source=cve · Note