5.4
CVE-2023-1023
- EPSS 0.23%
- Veröffentlicht 28.02.2023 13:15:10
- Zuletzt bearbeitet 21.11.2024 07:38:18
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginWP Meta SEO <= 4.5.3 - Missing Authorization in 'saveSitemapSettings'
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitemapSettings function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to change sitemap-related settings of the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Mögliche Gegenmaßnahme
WP Meta SEO: Update to version 4.5.4, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WP Meta SEO
Version
*-4.5.3
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Joomunited ≫ Wp Meta Seo SwPlatformwordpress Version <= 4.5.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.23% | 0.457 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
| security@wordfence.com | 5.4 | 2.8 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
|