Description
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
Published: 2023-04-17
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-12878 Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
History

Thu, 06 Feb 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Metagauss Themeflection Numbers
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2025-02-06T15:27:40.905Z

Reserved: 2023-02-17T11:21:42.024Z

Link: CVE-2023-0889

cve-icon Vulnrichment

Updated: 2024-08-02T05:24:34.701Z

cve-icon NVD

Status : Modified

Published: 2023-04-17T13:15:37.997

Modified: 2025-02-06T16:15:32.280

Link: CVE-2023-0889

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.