PT-2024-12659 · WordPress · Wpschoolpress

Fariq Fadillah Gusti Insani · Published 2024-12-13 · Updated 2024-12-17 · CVE-2023-37887

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WPSchoolPress versions 2.2.3 through 2.2.7

Description The issue involves a broken access control vulnerability, potentially exposing sensitive data. This vulnerability allows exploiting incorrectly configured access control security levels. Users are urged to update to the latest version to mitigate risks.

Recommendations Update to the latest version of the WPSchoolPress plugin to mitigate the risks associated with this issue. As a temporary workaround, consider restricting access to sensitive data until the update is applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-37887

Affected Products

Wpschoolpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-37887 · Security Note
• https://twitter.com/transilienceai/status/1867799673894826251 · Twitter Post
• https://twitter.com/transilienceai/status/1868524935112458620 · Twitter Post
• https://twitter.com/transilienceai/status/1868886840826069296 · Twitter Post
• https://twitter.com/CVEnew/status/1868033853195182447 · Twitter Post
• https://twitter.com/transilienceai/status/1868524926405079270 · Twitter Post
• https://twitter.com/transilienceai/status/1867799682765709649 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/wpschoolpress/vulnerability/wordpress-wpschoolpress-plugin-2-2-3-broken-access-control-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/wpschoolpress/vulnerability/wordpress-wpschoolpress-plugin-2-2-3-broken-access-control-vulnerability?_s_id=cve · Note