CVE-2023-5425

Name of the Vulnerable Software and Affected Versions Post Meta Data Manager plugin for WordPress version 1.2.0 and earlier

Description The issue is related to a missing capability check on the pmdm wp change user meta and pmdm wp change post meta functions. This allows authenticated attackers with subscriber-level permissions and above to gain elevated privileges, such as administrator privileges. The vulnerability can be exploited by remote attackers.

Recommendations For Post Meta Data Manager plugin for WordPress version 1.2.0 and earlier, consider disabling the pmdm wp change user meta and pmdm wp change post meta functions until a patch is available. Restrict access to these functions to minimize the risk of exploitation. Update to a version that includes a fix for this issue when available.