PT-2024-14541 · WordPress · Ovic Responsive Wpbakery Wordpress Plugin

Gibran Abdillah · Published 2024-01-08 · Updated 2025-06-11 · CVE-2023-5235

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ovic Responsive WPBakery WordPress plugin versions prior to 1.2.9

Description The issue allows attackers with a subscriber+ account to update blog options, such as users can register and default role, via some of its AJAX actions. It also unserializes user input, which may lead to Object Injection attacks.

Recommendations For versions prior to 1.2.9, update to version 1.2.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions that update blog options to minimize the risk of exploitation. Avoid using the users can register and default role options in the affected AJAX actions until the issue is resolved.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-5235

Affected Products

Ovic Responsive Wpbakery Wordpress Plugin

References · 6

• 🔥 https://wpscan.com/vulnerability/35c9a954-37fc-4818-a71f-34aaaa0fa3db · Exploit
• https://osv.dev/vulnerability/CVE-2023-5235 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5235 · Security Note
• https://twitter.com/CVEnew/status/1744453200525287821 · Twitter Post
• https://t.me/cvenotify/125404 · Telegram Post
• https://t.me/cvenotify/67116 · Telegram Post