PT-2023-30650 · WordPress · Wpforo Forum

Jesse Mcneil · Published 2023-11-30 · Updated 2023-12-06 · CVE-2023-47870

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wpForo Forum versions through 2.2.6

Description The issue is related to Cross-Site Request Forgery (CSRF) and Missing Authorization, allowing unauthorized access to functionality not properly constrained by Access Control Lists (ACLs). This can lead to forced log out of all users.

Recommendations For versions through 2.2.6, update to a version that includes a fix for this issue to prevent Cross-Site Request Forgery and unauthorized access. As a temporary workaround, consider restricting access to sensitive functionality to minimize the risk of exploitation.

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2023-47870

Affected Products

Wpforo Forum

References · 7

• https://osv.dev/vulnerability/CVE-2023-47870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47870 · Security Note
• https://twitter.com/VulmonFeeds/status/1730310512326451451 · Twitter Post
• https://twitter.com/CVEnew/status/1730296122961490140 · Twitter Post
• https://t.me/cvenotify/61740 · Telegram Post
• https://patchstack.com/database/vulnerability/wpforo/wordpress-wpforo-plugin-2-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/62523 · Telegram Post