The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Wordapp |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-34423 | The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 13 Jan 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2025-01-13T16:31:38.630Z
Reserved: 2023-05-30T14:13:59.154Z
Link: CVE-2023-2987
Vulnrichment
Updated: 2024-08-02T06:41:04.059Z
NVD
Status : Modified
Published: 2023-05-31T03:15:09.643
Modified: 2024-11-21T07:59:42.340
Link: CVE-2023-2987
Redhat
No data.
OpenCVE Enrichment
No data.