CVE-2023-51667 WordPress Rate my Post – WP Rating System plugin <= 3.4.2 - Broken Access Control vulnerability
Attackers can bypass authentication via spoofing to access restricted functionality in the Rate my Post WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-51667?
CVE-2023-51667 is a medium-severity authentication bypass vulnerability in FeedbackWP Rate my Post – WP Rating System, published on 4 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication Bypass by Spoofing vulnerability in FeedbackWP Rate my Post – WP Rating System allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.2.
Weakness: CWE-290
Which versions are affected by CVE-2023-51667?
It affects 1 product.
Products include Blazzdev Rate My Post.
How do I fix CVE-2023-51667?
No fix has been published for CVE-2023-51667 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-51667 being exploited?
There is no known exploitation of CVE-2023-51667 in the wild and no public exploit code.
Other vulnerabilities in FeedbackWP Rate my Post – WP Rating System
- CVE-2022-4673 Rate my Post – WP Rating System < 3.3.9 - Contributor+ Stored XSS via Shortcode
- CVE-2024-32823 WordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2023-49765 WordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR)
Sources
Also known as GHSA-p863-q32c-8f73.