CVE-2023-5974 WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery

Q: What is CVE-2023-5974?

CVE-2023-5974 is a critical server-side request forgery vulnerability in Unknown wpb-show-core, published on 27 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2023-5974 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5974 exists.

Q: How do I fix CVE-2023-5974?

No fix has been published for CVE-2023-5974 yet. Limit exposure of the affected software until one is available.

Critical 9.8 Published 27 Nov 2023 Updated 21 Nov 2024

Unauthenticated attackers can exploit a server-side request forgery vulnerability in the WPB Show Core plugin to access internal resources.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-5974?

CVE-2023-5974 is a critical server-side request forgery vulnerability in Unknown wpb-show-core, published on 27 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WPB Show Core WordPress plugin through 2.2 is vulnerable to server-side request forgery (SSRF) via the `path` parameter.

Weakness: CWE-918

Which versions are affected by CVE-2023-5974?

It affects 1 product.

Products include Wpb Show Core Project Wpb Show Core.

How do I fix CVE-2023-5974?

No fix has been published for CVE-2023-5974 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-5974 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5974 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-mpgc-x575-hg38.