PT-2024-14858 · WordPress · Eazydocs

Dao Xuan Hieu · Published 2024-01-15 · Updated 2024-10-09 · CVE-2023-6029

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions EazyDocs WordPress plugin versions prior to 2.3.6

Description The issue allows unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections, due to the lack of authorization and CSRF checks when handling documents. This is because the plugin does not ensure that the documents are from the plugin itself.

Recommendations For versions prior to 2.3.6, update to version 2.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the document handling functionality until a patch is applied. Avoid using the plugin's document management features with unauthenticated users until the issue is resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-6029

Affected Products

Eazydocs

References · 8

• 🔥 https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-6029 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6029 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1746949625016131938 · Twitter Post
• https://twitter.com/CVEnew/status/1757077024437575696 · Twitter Post
• https://t.me/cvenotify/97594 · Telegram Post
• https://twitter.com/CVEnew/status/1746914244199891306 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1757097690008035832 · Twitter Post