The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-05-31T02:40:20.868Z
Updated: 2024-08-02T06:41:04.059Z
Reserved: 2023-05-30T14:13:59.154Z
Link: CVE-2023-2987
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-05-31T03:15:09.643
Modified: 2024-11-21T07:59:42.340
Link: CVE-2023-2987
Redhat
No data.