4.3

CVE-2023-0453

Exploit

WP Private Message < 1.0.6 - Private Message Disclosure via IDOR

WP Private Message < 1.0.6 - Insecure Direct Object Reference

The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.
Mögliche Gegenmaßnahme
WP Private Message: Update to version 1.0.6, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apusthemes ≫ Wp Private Messaging SwPlatformwordpress Version < 1.0.6
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WP Private Message
Version [*, 1.0.6)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.55% 0.417
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://themeforest.net/item/superio-job-board-wordpress-theme/32180231
Product
https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-aec1-c3be11e2a6de
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/14026e96-7e21-45db-b258-13b014ec478c
Third Party Advisory