CVE-2023-6029

Published Jan 15, 2024

Last updated 10 months ago

Overview

Description: The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections.
Source: contact@wpscan.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-862

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:spider-themes:eazydocs:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "241F442D-2084-47E2-B4A4-3B8BCA0C4020",
            "versionEndExcluding": "2.3.6"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References