CVE-2023-1979 Auth bypass in Web Stories for WordPress plugin
Authors can bypass password protection to access protected Web Stories content via the duplication feature.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1979?
CVE-2023-1979 is a medium-severity authentication bypass vulnerability in Google Web Stories for WordPress, published on 8 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68
Weakness: CWE-863
Which versions are affected by CVE-2023-1979?
It affects 1 product.
Products include Google Web Stories.
How do I fix CVE-2023-1979?
No fix has been published for CVE-2023-1979 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-1979 being exploited?
There is no known exploitation of CVE-2023-1979 in the wild and no public exploit code.
Other vulnerabilities in Google Web Stories for WordPress
Sources
Also known as GHSA-p77r-crfj-p4f9.