PT-2024-15253 · WordPress · Import Wp

Mr Empy · Published 2024-04-24 · Updated 2024-07-03 · CVE-2023-7253

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Import WP WordPress plugin versions prior to 2.13.1

Description The issue allows users with the administrator role to conduct SSRF attacks, which may be a problem in multisite configurations. This is due to the lack of prevention of pinging by users with the administrator role.

Recommendations For versions prior to 2.13.1, update to version 2.13.1 or later to resolve the issue. As a temporary workaround, consider restricting the administrator role's capabilities to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-7253

Affected Products

Import Wp

References · 4

• 🔥 https://wpscan.com/vulnerability/aeefcc01-bbbf-4d86-9cfd-ea0f9a85e1a5 · Exploit
• https://osv.dev/vulnerability/CVE-2023-7253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7253 · Security Note
• https://t.me/cvenotify/77849 · Telegram Post