WordPress Grid Plus plugin <= 1.3.2 - Broken Access Control vulnerability
CVE-2023-34014

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Grid Plus
Vendor
CVE Published:
13 December 2024

What is CVE-2023-34014?

A Missing Authorization vulnerability in G5Theme’s Grid Plus plugin allows attackers to exploit incorrectly configured access control security levels, potentially granting unauthorized access to sensitive information or functionalities. This affects versions ranging from n/a to 1.3.2, highlighting the importance of proper configuration to safeguard against unauthorized access. It is essential for users to review their configurations and update to the latest versions to mitigate the risks associated with this vulnerability.

Affected Version(s)

Grid Plus <= 1.3.2

References

https://patchstack.com/database/wordpress/plugin/grid-plu...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdi Pranata (Patchstack Alliance)
JSON
.