Data Modification Vulnerabilities in WP Directory Kit Plugin by WordPress

CVE-2023-2280

What is CVE-2023-2280?

The WP Directory Kit plugin for WordPress is susceptible to unauthorized data modification stemming from a missing capability check in its 'ajax_public' function. This vulnerability affects versions up to 1.2.2, enabling unauthenticated attackers to manipulate plugin settings, import demo data, and delete associated posts and terms. Moreover, it allows the installation of arbitrary plugins, posing a significant security risk. Although partial patches were introduced in versions 1.2.0 and 1.2.2, the vulnerability was not fully resolved until the release of version 1.2.3.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References