CVE-2023-4703 All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege Escalation
Unauthenticated attackers can update any user's details, including admin passwords, leading to full site takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4703?
CVE-2023-4703 is a high-severity vulnerability in Unknown All in One B2B for WooCommerce, published on 16 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation.
Which versions are affected by CVE-2023-4703?
It affects 1 product.
Products include All in One B2b for Woocommerce Project All in One B2b for Woocommerce.
How do I fix CVE-2023-4703?
No fix has been published for CVE-2023-4703 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4703 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4703 exists.
Other vulnerabilities in Unknown All in One B2B for WooCommerce
Sources
Also known as GHSA-8wmq-h9m8-m384.