PT-2024-15071 · WordPress · Wp Customer Area

Krzysztof Zając · Published 2024-01-16 · Updated 2024-01-23 · CVE-2023-6741

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Customer Area WordPress plugin versions prior to 8.2.1

Description The issue arises from the plugin not properly validating users' capabilities in some of its AJAX actions. This allows malicious users to edit other users' account addresses.

Recommendations For versions prior to 8.2.1, update to version 8.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX actions that are vulnerable to capability validation bypass until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2023-6741

Affected Products

Wp Customer Area

References · 6

• 🔥 https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-6741 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6741 · Vendor Advisory
• https://t.me/cvenotify/68341 · Telegram Post
• https://twitter.com/CVEnew/status/1747293136614010881 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1747313347706433921 · Twitter Post