Authorization Bypass Vulnerability in Wordapp Plugin for WordPress

CVE-2023-2987

What is CVE-2023-2987?

The Wordapp plugin for WordPress exhibits a vulnerability that allows unauthorized users to bypass authorization mechanisms due to the use of an insufficiently unique cryptographic signature in the 'wa_pdx_op_config_set' function. This weakness affects versions up to and including 1.5.0, enabling unauthenticated attackers to alter the 'validation_token' within the plugin's configuration. As a result, attackers can exploit this vulnerability to access crucial remote control functionalities, such as generating administrative access URLs, potentially leading to privilege escalation and compromising the security of the WordPress site.

References