CVE-2023-3999 Waiting: One-click countdowns <= 0.6.2 - Missing Authorization
Authenticated subscribers can create, delete, and modify countdowns and settings due to missing capability checks in AJAX calls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3999?
CVE-2023-3999 is a medium-severity missing authorization vulnerability in pluginbuilders Waiting: One-click countdowns, published on 31 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to, and including, 0.6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create and delete countdowns as well as manipulate other plugin settings.
Weakness: CWE-862
Which versions are affected by CVE-2023-3999?
It affects 1 product.
Products include Plugin Waiting.
How do I fix CVE-2023-3999?
No fix has been published for CVE-2023-3999 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-3999 being exploited?
There is no known exploitation of CVE-2023-3999 in the wild and no public exploit code.
Other vulnerabilities in pluginbuilders Waiting: One-click countdowns
- CVE-2023-28659 SQL injection in Waiting: One-click Countdowns WordPress Plugin
- CVE-2023-2757 Cross-site scripting in Waiting: One-click countdowns
- CVE-2023-4000 Waiting: One-click countdowns <= 0.6.2 - Cross-Site Request Forgery
- CVE-2022-4954 Waiting: One-click countdowns <= 0.6.2 - Authenticated (Administrator+) Cross-Site Scripting
Sources
Also known as GHSA-3744-v8vp-h2jq.