4.3
CVE-2023-1026
- EPSS 0.24%
- Veröffentlicht 28.02.2023 13:15:10
- Zuletzt bearbeitet 21.11.2024 07:38:18
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginWP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory'
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to get post listings by category as long as those posts are published. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Mögliche Gegenmaßnahme
WP Meta SEO: Update to version 4.5.4, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WP Meta SEO
Version
*-4.5.3
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Joomunited ≫ Wp Meta Seo SwPlatformwordpress Version <= 4.5.3
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.24% | 0.467 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
| security@wordfence.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|