Unauthorized Data Modification in Post Meta Data Manager for WordPress
CVE-2023-5426

7.5HIGH

Key Information:

Vendor
Wordpress
Status
Post Meta Data Manager
Vendor
CVE Published:
28 October 2023

Summary

The Post Meta Data Manager plugin for WordPress has a vulnerability that allows unauthenticated attackers to delete user, term, and post meta data. This issue arises from a lack of proper capability checks in the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to and including 1.2.0. As a result, attackers can maliciously manipulate data belonging to any user, leading to potential data loss and integrity issues.

Affected Version(s)

Post Meta Data Manager * <= 1.2.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/2981559/post...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.