PT-2023-6744 · WordPress · Post Meta Data Manager

Francesco Carlucci · Published 2023-10-27 · Updated 2023-11-07 · CVE-2023-5425

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Post Meta Data Manager plugin for WordPress version 1.2.0 and earlier

Description The issue is related to a missing capability check on the pmdm wp change user meta and pmdm wp change post meta functions. This allows authenticated attackers with subscriber-level permissions and above to gain elevated privileges, such as administrator privileges. The vulnerability can be exploited by remote attackers.

Recommendations For Post Meta Data Manager plugin for WordPress version 1.2.0 and earlier, consider disabling the pmdm wp change user meta and pmdm wp change post meta functions until a patch is available. Restrict access to these functions to minimize the risk of exploitation. Update to a version that includes a fix for this issue when available.

Fix

Missing Authorization

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-285

CWE-863

Related Identifiers

BDU:2023-07529

CVE-2023-5425

Affected Products

Post Meta Data Manager

References · 9

• https://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager · Patch
• https://bdu.fstec.ru/vul/2023-07529 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d7f4e710-99a2-49df-a513-725e1daaa18a?source=cve · Patch
• https://osv.dev/vulnerability/CVE-2023-5425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5425 · Security Note
• https://twitter.com/CVEnew/status/1718224126484136250 · Twitter Post
• http://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager · Note
• https://cybersecurity-help.cz/vdb/SB2023103036 · Note
• https://t.me/cibsecurity/73107 · Telegram Post