CVE-2023-0328 WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion
Authenticated users with post-editing privileges can modify or delete WPCode Library authentication keys due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0328?
CVE-2023-0328 is a medium-severity missing authorization vulnerability in Unknown WPCode, published on 6 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).
Weakness: CWE-863
Which versions are affected by CVE-2023-0328?
It affects 1 product.
Products include Wpcode Wpcode.
How do I fix CVE-2023-0328?
No fix has been published for CVE-2023-0328 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-0328 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0328 exists.
Other vulnerabilities in Unknown WPCode
Sources
Also known as GHSA-fc29-rq2p-4h73.