PT-2023-32595 · WordPress · Siteorigin Widgets Bundle

Sebastian Neef · Published 2023-12-12 · Updated 2024-01-03 · CVE-2023-6295

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiteOrigin Widgets Bundle WordPress plugin versions prior to 1.51.0

Description The issue allows users with the administrator role to perform Local File Inclusion (LFI) attacks in the context of Multisite WordPress sites. This is due to the plugin not validating user input before using it to generate paths passed to include function/s.

Recommendations For versions prior to 1.51.0, update to version 1.51.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for users with the administrator role until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2023-6295

Affected Products

Siteorigin Widgets Bundle

References · 10

• 🔥 https://wpscan.com/vulnerability/adc9ed9f-55b4-43a9-a79d-c7120764f47c · Exploit
• https://osv.dev/vulnerability/CVE-2023-6295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6295 · Security Note
• https://t.me/cvenotify/64758 · Telegram Post
• https://twitter.com/CVEnew/status/1736842767341326354 · Twitter Post
• https://t.me/cybersecuritytechnologies/9594 · Telegram Post
• https://twitter.com/Dinosn/status/1734907720212328945 · Twitter Post
• https://twitter.com/Dinosn/status/1742579039745843581 · Twitter Post
• https://twitter.com/gehaxelt/status/1734628178524594400 · Twitter Post
• https://t.me/freedomf0x/20785 · Telegram Post