CVE-2023-0328

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 52.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown WpcodeWpcode Wpcode
Timeline
PublishedMar 6

Description

The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDwpcode/wpcode< 2.0.7
▶CVEListV5unknown/wpcode< 2.0.7

🔴Vulnerability Details

2
CVEList
WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion↗2023-03-06
▶
GHSA
GHSA-fc29-rq2p-4h73: The WPCode WordPress plugin before 2↗2023-03-06
▶
CVE-2023-0328 (MEDIUM CVSS 4.3) | The WPCode WordPress plugin before | cvebase.io