REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion
CVE-2023-0551

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Rest Api To Miniprogram
Vendor
CVE Published:
16 August 2023

Summary

The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments

Affected Version(s)

REST API TO MiniProgram 0 <= 4.6.1

References

https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lana Codes
WPScan
.