Unauthorized Data Access in System Dashboard Plugin for WordPress

CVE-2023-5714

What is CVE-2023-5714?

The System Dashboard plugin for WordPress is vulnerable due to a missing capability check on the sd_db_specs() function exposed through an AJAX action. This flaw allows authenticated users with subscriber-level access and higher to exploit the vulnerability and gain unauthorized access to sensitive data key specifications. The issue affects all versions up to and including 2.8.7, necessitating immediate updates to ensure the security of user data.

References