PT-2024-15145 · WordPress · Getwid

Lucio Sá · Published 2024-02-05 · Updated 2024-11-25 · CVE-2023-6963

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Getwid – Gutenberg Blocks plugin for WordPress versions up to, and including, 2.0.4

Description The issue allows unauthenticated attackers to bypass the Captcha Verification of the Contact Form block by omitting the g-recaptcha-response from the data array. This enables potential abuse of the contact form without proper verification.

Recommendations For versions up to, and including, 2.0.4, update to a version higher than 2.0.4 to resolve the issue. As a temporary workaround, consider implementing additional verification measures for the Contact Form block until a patch is available. Restrict access to the Contact Form block to minimize the risk of exploitation. Avoid using the Contact Form block until the issue is resolved.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-804

Related Identifiers

CVE-2023-6963

Affected Products

Getwid

References · 5

• https://osv.dev/vulnerability/CVE-2023-6963 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3022982 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-6963 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d317f2c7-06f3-4875-9f9b-eb7f450aa2f4?source=cve · Note
• https://twitter.com/CVEnew/status/1754620493288636563 · Twitter Post