CVE-2023-5610 Seraphinite Accelerator < 2.20.29 - Authenticated Arbitrary Redirect
An authenticated user can be redirected to arbitrary external URLs due to missing validation in the Seraphinite Accelerator WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-5610?
CVE-2023-5610 is a medium-severity vulnerability in Unknown Seraphinite Accelerator, published on 20 Nov 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect
Weakness: CWE-601
Which versions are affected by CVE-2023-5610?
It affects 1 product.
Products include S-Sols Seraphinite Accelerator.
How do I fix CVE-2023-5610?
No fix has been published for CVE-2023-5610 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-5610 being exploited?
There is no known exploitation of CVE-2023-5610 in the wild and no public exploit code.
Other vulnerabilities in Unknown Seraphinite Accelerator
- CVE-2023-49740 WordPress Seraphinite Accelerator Plugin <= 2.20.28 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-1568 Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck
- CVE-2023-5609 Seraphinite Accelerator < 2.20.29 - Reflected XSS
- CVE-2023-5611 Seraphinite Accelerator < 2.20.32 - Unauthorised Settings Reset/Import
- CVE-2026-3058 Information disclosure in Seraphinite Accelerator
Sources
Also known as GHSA-hx6v-27f6-jgp7.