tagDiv Cloud Library < 2.7 - Unauthenticated Arbitrary User Metadata Update to Privilege Escalation

CVE-2023-1597

What is CVE-2023-1597?

The tagDiv Cloud Library plugin for WordPress, prior to version 2.7, lacks necessary authorization checks and is susceptible to Cross-Site Request Forgery (CSRF). This vulnerability allows both unauthenticated and authenticated users to access an AJAX action, enabling unauthorized alteration of user metadata. As a consequence, an attacker could exploit this flaw to escalate privileges, potentially granting themselves administrative rights to the blog.

References