CVE-2023-2448
UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to arbitrary shortcode execution. An attacker can leverage CVE-2023-2446 to get sensitive information via shortcode.
El complemento UserPro para WordPress es vulnerable al acceso no autorizado a los datos debido a una falta de verificación de capacidad en la función 'userpro_shortcode_template' en versiones hasta la 5.1.4 incluida. Esto hace posible que atacantes no autenticados ejecuten códigos cortos arbitrarios. Un atacante puede aprovechar CVE-2023-2446 para obtener información confidencial mediante un código corto.
WordPress UserPro plugin versions 5.1.1 and below suffer from an insecure password reset mechanism, information disclosure, and authentication bypass vulnerabilities. Versions 5.1.4 and below suffer from privilege escalation and shortcode execution vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-05-01 CVE Reserved
- 2023-11-21 CVE Published
- 2024-08-02 CVE Updated
- 2024-10-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-862: Missing Authorization
CAPEC
References (3)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Userproplugin Search vendor "Userproplugin" | Userpro Search vendor "Userproplugin" for product "Userpro" | <= 5.1.4 Search vendor "Userproplugin" for product "Userpro" and version " <= 5.1.4" | wordpress |
Affected
|