CVE-2023-5311 WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification

What is CVE-2023-5311?

CVE-2023-5311 is a high-severity missing authorization vulnerability in wpvncom WP EXtra – One Click Optimize, published on 25 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the contents of the .htaccess files located in a site's root directory or /wp-content and /wp-includes folders and achieve remote code execution. CVE-2023-46623 appears to be a duplicate of this issue.

Weakness: CWE-862

Which versions are affected by CVE-2023-5311?

It affects 1 product.

Products include Wpvnteam Wp Extra.

How do I fix CVE-2023-5311?

No fix has been published for CVE-2023-5311 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-5311 being exploited?

There is no known exploitation of CVE-2023-5311 in the wild and no public exploit code.

Other vulnerabilities in wpvncom WP EXtra – One Click Optimize

• CVE-2023-46623 WordPress WP EXtra Plugin <= 6.2 is vulnerable to Remote Code Execution (RCE) Critical 9.9
• CVE-2023-46212 WordPress WP EXtra Plugin <= 6.2 is vulnerable to Broken Access Control Medium 6.3
• CVE-2023-47825 WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF) Medium 4.3
• CVE-2023-5314 WP EXtra <= 6.2 - Missing Authorization to Arbitrary Email Sending Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p3gw-wp5c-9ccx.