CVE-2023-5559

Published Nov 27, 2023

Last updated 5 months ago

CVSS critical 9.1

Overview

Description: The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:10web:10web_booster:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3DAA777F-5807-4D4F-8A86-E904B2A70665",
            "versionEndExcluding": "2.24.18"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References