PT-2023-32291 · WordPress · Wordpress Backup & Migration

Krzysztof Zając

·

CVE-2023-5737

·

Publicado

2023-11-27

·

Atualizado

2023-12-01

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions WordPress Backup & Migration WordPress plugin versions prior to 1.4.4
Description The issue allows users with a role as low as Subscriber to update some plugin settings due to a lack of authorization for certain AJAX requests.
Recommendations For versions prior to 1.4.4, update to version 1.4.4 or later to resolve the issue.

Exploit

Correção

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-5737

Produtos afetados

Wordpress Backup & Migration