myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion
CVE-2023-5509

5.4MEDIUM

Key Information:

Vendor: Wordpress
Status: Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme
Vendor: CVE Published:; 20 November 2023

The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.

Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme 0 < 2.6.5

Score:

5.4

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Krzysztof Zając

WPScan