Unauthorized Data Loss in EmbedPress Plugin for WordPress
CVE-2023-4282

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor
Vendor
CVE Published:
10 August 2023

Summary

The EmbedPress plugin for WordPress contains a flaw that allows authenticated users with subscriber privileges or higher to bypass security checks. This vulnerability arises from a missing capability check in the 'admin_post_remove' and 'remove_private_data' functions. As a result, these users can delete critical plugin settings, leading to unauthorized loss of data within the application. It is crucial for users of EmbedPress to update to the latest version to mitigate this risk and ensure the integrity of their data.

Affected Version(s)

EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor * <= 3.8.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/embedpress/tag...
https://plugins.trac.wordpress.org/browser/embedpress/tag...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lana Codes
.