WordPress Portfolio and Projects plugin <= 1.3.7 - Broken Access Control vulnerability

CVE-2023-39995

What is CVE-2023-39995?

A missing authorization vulnerability exists in WP OnlineSupport's Portfolio and Projects plugin, which allows attackers to exploit incorrectly configured access control security levels. This vulnerability impacts users by potentially granting unauthorized access to sensitive functionalities within the plugin. Specifically, the issue has been identified in versions from n/a up to 1.3.7, making it essential for users to review their access control settings and update the plugin to mitigate potential exposure.

References