Unauthorized Data Loss in EmbedPress Plugin for WordPress
CVE-2023-4282
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 10 August 2023
What is CVE-2023-4282?
The EmbedPress plugin for WordPress contains a flaw that allows authenticated users with subscriber privileges or higher to bypass security checks. This vulnerability arises from a missing capability check in the 'admin_post_remove' and 'remove_private_data' functions. As a result, these users can delete critical plugin settings, leading to unauthorized loss of data within the application. It is crucial for users of EmbedPress to update to the latest version to mitigate this risk and ensure the integrity of their data.
Affected Version(s)
EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor * <= 3.8.2