PT-2024-14871 · WordPress · Wp Custom Widget Area

Krzysztof Zając · Published 2024-01-15 · Updated 2024-01-19 · CVE-2023-6066

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Custom Widget area WordPress plugin versions 1.2.5 and earlier

Description The issue arises from the plugin not properly applying capability and nonce checks on its AJAX action callback functions. This could allow attackers with subscriber+ privilege to create, delete, or modify menus on the site.

Recommendations For versions 1.2.5 and earlier, update to a version that properly applies capability and nonce checks on AJAX action callback functions. As a temporary workaround, consider restricting access to the AJAX action callback functions until a patch is available.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-6066

Affected Products

Wp Custom Widget Area

References · 6

• 🔥 https://wpscan.com/vulnerability/f8f84d47-49aa-4258-a8a6-3de8e7342623 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-6066 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6066 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1746952680226824281 · Twitter Post
• https://twitter.com/CVEnew/status/1746914234720825713 · Twitter Post
• https://t.me/cvenotify/68064 · Telegram Post