CVE-2023-5426

Name of the Vulnerable Software and Affected Versions Post Meta Data Manager plugin for WordPress versions up to, and including, 1.2.0

Description The issue is related to incorrect authorization procedures in the pmdm wp delete user meta, pmdm wp delete term meta, and pmdm wp ajax delete meta functions of the Post Meta Data Manager plugin for WordPress. This allows a remote attacker to delete user, term, and post meta belonging to arbitrary users due to a missing capability check.

Recommendations For versions up to, and including, 1.2.0, consider disabling the pmdm wp delete user meta, pmdm wp delete term meta, and pmdm wp ajax delete meta functions until a patch is available to prevent unauthorized data modification. Restrict access to these functions to minimize the risk of exploitation. Avoid using these functions in the affected plugin until the issue is resolved.