Unauthorized Data Access in System Dashboard Plugin for WordPress

CVE-2023-5713

Summary

The System Dashboard plugin for WordPress possesses a significant vulnerability due to a missing capability check on the sd_option_value() function, which is triggered by AJAX actions. This flaw is present in all versions up to and including 2.8.7, allowing authenticated attackers with subscriber-level access or higher to exploit the vulnerability. Consequently, these attackers can access sensitive option values and deserialize their content, posing a potential risk to user data and overall site integrity.

References