PT-2024-15181 · WordPress · The Lightstart – Maintenance Mode

Lucio Sá · Published 2024-01-11 · Updated 2024-01-17 · CVE-2023-7019

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress versions up to, and including, 2.6.8

Description The issue is related to a missing capability check on the insert template function, allowing authenticated attackers with subscriber-level access and above to modify page designs. This can lead to unauthorized modification of data.

Recommendations For versions up to, and including, 2.6.8, update to a version higher than 2.6.8 to resolve the issue. As a temporary workaround, consider restricting access to the insert template function to prevent unauthorized modifications.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-7019

Affected Products

The Lightstart – Maintenance Mode

References · 7

• https://osv.dev/vulnerability/CVE-2023-7019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7019 · Security Note
• https://t.me/cvenotify/67805 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b57d3d1d-dcdb-4f11-82d8-183778baa075?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3013229/wp-maintenance-mode/trunk/includes/classes/wp-maintenance-mode-admin.php?contextall=1&old=2922691&old_path=%2Fwp-maintenance-mode%2Ftrunk%2Fincludes%2Fclasses%2Fwp-maintenance-mode-admin.php · Note
• https://twitter.com/VulmonFeeds/status/1745412238528126981 · Twitter Post
• https://twitter.com/CVEnew/status/1745365011009249354 · Twitter Post