CVE-2023-4023 All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR
Non-administrator users can delete messages from the All Users Messenger plugin due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4023?
CVE-2023-4023 is a medium-severity missing authorization vulnerability in Unknown All Users Messenger, published on 30 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.
Which versions are affected by CVE-2023-4023?
It affects 1 product.
Products include Riverforest-Wp All Users Messenger.
How do I fix CVE-2023-4023?
No fix has been published for CVE-2023-4023 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-4023 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4023 exists.
Sources
Also known as GHSA-7rm2-xq32-ww37.