PT-2024-15248 · WordPress · Login As User/Customer

Dmitry Ignatyev · Published 2024-02-27 · Updated 2025-05-01 · CVE-2023-7247

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Login as User or Customer WordPress plugin versions 3.8 and earlier

Description The issue allows users to log in as any other user on the site, potentially leading to complete administrator account takeover. It is crucial to keep WordPress plugins up-to-date to prevent such attacks.

Recommendations For versions 3.8 and earlier, update the Login as User or Customer WordPress plugin to a version later than 3.8 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the site to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-7247

Affected Products

Login As User/Customer

References · 8

• 🔥 https://wpscan.com/vulnerability/96b93253-31d0-4184-94b7-f1e18355d841 · Exploit
• 🔥 https://drive.google.com/file/d/1GCOzJ-ZovYij9GIdmsrZrR9g8mlC22hs/view?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7247 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7247 · Vendor Advisory
• https://t.me/cvenotify/90080 · Telegram Post
• https://twitter.com/CVEnew/status/1767253908383010855 · Twitter Post
• https://t.me/cvenotify/120420 · Telegram Post
• https://twitter.com/cleantalkcloud/status/1762385909759328478 · Twitter Post