PT-2024-15053 · WordPress · Beaver Themer

Francesco Carlucci · CVE-2023-6695 · Published 2024-04-09 · Updated 2025-05-06

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Beaver Themer plugin for WordPress versions up to, and including, 1.4.9

Description The issue allows authenticated attackers with contributor access and above to extract sensitive data, including arbitrary user meta values, via the 'wpbb' shortcode. This makes it possible for them to access sensitive information.

Recommendations For versions up to, and including, 1.4.9, consider disabling the 'wpbb' shortcode until a patch is available to prevent exploitation. Restrict access to sensitive data and limit contributor access to minimize the risk of sensitive information exposure.

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2023-6695

Affected Products

Beaver Themer

References · 8

• https://osv.dev/vulnerability/CVE-2023-6695 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6695 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4165cff7-457d-4790-8678-84c4365a191a?source=cve · Note
• https://t.me/cvenotify/76224 · Telegram Post
• https://t.me/cvenotify/121012 · Telegram Post
• https://wpbeaverbuilder.com/change-logs · Note
• https://twitter.com/VulmonFeeds/status/1777822190261407968 · Twitter Post
• https://twitter.com/CVEnew/status/1777891020711272683 · Twitter Post