PT-2023-30158 · WordPress · Ad Inserter

Marco Wotschka · Published 2023-10-20 · Updated 2023-10-27 · CVE-2023-4668

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Ad Inserter for WordPress versions up to, and including, 2.7.30

Description The issue allows unauthenticated attackers to extract sensitive data including installed plugins, active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit and installation paths. This is achieved via the ai-debug-processing-fe URL parameter.

Recommendations For versions up to, and including, 2.7.30, consider disabling the ai-debug-processing-fe URL parameter until a patch is available to prevent sensitive information exposure. Restrict access to sensitive data and server settings to minimize the risk of exploitation. Update to a version higher than 2.7.30 when available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-4668

Affected Products

Ad Inserter

References · 8

• https://osv.dev/vulnerability/CVE-2023-4668 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2969942%40ad-inserter%2Ftags%2F2.7.31&old=2922718%40ad-inserter%2Ftrunk · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-4668 · Security Note
• https://t.me/cibsecurity/72673 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1715328034075451738 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ce457c98-c55b-4b71-a80b-393eceb9effd?source=cve · Note
• https://t.me/cvenotify/59793 · Telegram Post
• https://twitter.com/CVEnew/status/1715271093521363233 · Twitter Post