Functionality Misuse via Missing Authorization
CVE-2023-32127

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Multi Rating
Vendor
CVE Published:
24 April 2024

What is CVE-2023-32127?

A missing authorization vulnerability exists in the Multi Rating plugin developed by Daniel Powney, allowing unauthorized users to exploit the functionality of the plugin. This can lead to misuse, including arbitrary rating value changes. The issue affects versions up to 5.0.6 and highlights the importance of proper user role management and access controls to mitigate such risks.

Affected Version(s)

Multi Rating <= 5.0.6

References

https://patchstack.com/database/vulnerability/multi-ratin...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

yuyudhn (Patchstack Alliance)
.