Unauthorized Data Access in System Dashboard Plugin for WordPress

CVE-2023-5710

Summary

The System Dashboard plugin for WordPress has a vulnerability that allows authenticated attackers, who have subscriber-level access or higher, to exploit a missing capability check in the sd_constants() function. This security flaw, present in all versions up to and including 2.8.7, enables unauthorized access to sensitive information such as database credentials through an AJAX action, thus posing a significant risk to data integrity and privacy.

References