Unauthorized Data Modification in 10Web AI Assistant for WordPress

CVE-2023-6985

Summary

The 10Web AI Assistant, an AI content writing plugin for WordPress, contains a security flaw that allows unauthorized data modification due to a missing capability check on the install_plugin AJAX action. This vulnerability impacts all versions up to and including 1.0.18. Authenticated attackers with subscriber-level access or above can exploit this weakness to install arbitrary plugins, potentially compromising the integrity and security of affected WordPress sites. It is crucial for users to assess their installations and apply necessary updates to mitigate risk.

References