Unauthorized Data Access in System Dashboard Plugin for WordPress
CVE-2023-5714

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
System Dashboard
Vendor
CVE Published:
7 December 2023

Summary

The System Dashboard plugin for WordPress is vulnerable due to a missing capability check on the sd_db_specs() function exposed through an AJAX action. This flaw allows authenticated users with subscriber-level access and higher to exploit the vulnerability and gain unauthorized access to sensitive data key specifications. The issue affects all versions up to and including 2.8.7, necessitating immediate updates to ensure the security of user data.

Affected Version(s)

System Dashboard * <= 2.8.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/system-dashboa...
https://plugins.trac.wordpress.org/browser/system-dashboa...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
.