CVE-2023-40004 Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins
Unauthenticated attackers can manipulate access tokens to bypass authorization checks in ServMask WordPress migration extensions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-40004?
CVE-2023-40004 is a high-severity missing authorization vulnerability in ServMask All-in-One WP Migration Box Extension, published on 19 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in ServMask All-in-One WP Migration Box Extension, ServMask All-in-One WP Migration OneDrive Extension, ServMask All-in-One WP Migration Dropbox Extension, ServMask All-in-One WP Migration Google Drive Extension.This issue affects All-in-One WP Migration Box Extension: from n/a through 1.53; All-in-One WP Migration OneDrive Extension: from n/a through 1.66; All-in-One WP Migration Dropbox Extension: from n/a through 3.75; All-in-One WP Migration Google Drive Extension: from n/a through 2.79.
Weakness: CWE-862
Which versions are affected by CVE-2023-40004?
How do I fix CVE-2023-40004?
No fix has been published for CVE-2023-40004 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-40004 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-40004 exists.
Sources
Also known as GHSA-4rwm-74mf-prpv.