WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerability
CVE-2023-36531

4.3MEDIUM

Key Information:

Vendor
WordPress
Status
Liquidpoll – Advanced Polls For Creators And Brands
Vendor
CVE Published:
13 December 2024

Summary

A vulnerability exists in LiquidPoll – Advanced Polls for Creators and Brands that stems from a lack of proper authorization mechanisms. This security issue arises due to incorrectly configured access control settings, which may allow unauthorized users to exploit the system and gain access to sensitive functionalities. The vulnerability affects all versions of the product before 3.3.68, putting a substantial number of installations at risk of security breaches. Proper access control measures are essential to safeguard user data and maintain the integrity of online polling services.

Affected Version(s)

LiquidPoll – Advanced Polls for Creators and Brands <= 3.3.68

References

https://patchstack.com/database/wordpress/plugin/wp-poll/...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdi Pranata (Patchstack Alliance)
.