PT-2023-6743 · WordPress · Post Meta Data Manager
Francesco Carlucci
·
Published
2023-10-27
·
Updated
2023-11-08
·
CVE-2023-5426
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Post Meta Data Manager plugin for WordPress versions up to, and including, 1.2.0
Description
The issue is related to incorrect authorization procedures in the
pmdm wp delete user meta, pmdm wp delete term meta, and pmdm wp ajax delete meta functions of the Post Meta Data Manager plugin for WordPress. This allows a remote attacker to delete user, term, and post meta belonging to arbitrary users due to a missing capability check.Recommendations
For versions up to, and including, 1.2.0, consider disabling the
pmdm wp delete user meta, pmdm wp delete term meta, and pmdm wp ajax delete meta functions until a patch is available to prevent unauthorized data modification.
Restrict access to these functions to minimize the risk of exploitation.
Avoid using these functions in the affected plugin until the issue is resolved.Fix
Missing Authorization
Improper Authorization
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Post Meta Data Manager