CVE-2023-31073

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-31073", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2023-04-24T05:42:59.931Z", "datePublished": "2024-12-09T11:31:00.349Z", "dateUpdated": "2026-04-28T16:08:20.201Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "shortcode-to-display-post-and-user-data", "product": "Display custom fields in the frontend \u2013 Post and User Profile Fields", "vendor": "Jose Vega", "versions": [{"changes": [{"at": "1.2.1", "status": "unaffected"}], "lessThanOrEqual": "1.2.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Yuki Haruma (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend \u2013 Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.</p><p>This issue affects Display custom fields in the frontend \u2013 Post and User Profile Fields: from n/a through 1.2.0.</p>"}], "value": "Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend \u2013 Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend \u2013 Post and User Profile Fields: from n/a through 1.2.0."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:08:20.201Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/shortcode-to-display-post-and-user-data/vulnerability/wordpress-shortcode-to-display-post-and-user-data-plugin-1-2-0-broken-access-control-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress Display custom fields in the frontend \u2013 Post and User Profile Fields plugin to the latest available version (at least 1.2.1)."}], "value": "Update the WordPress Display custom fields in the frontend \u2013 Post and User Profile Fields plugin to the latest available version (at least 1.2.1)."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Shortcode to display post and user data plugin <= 1.2.0 - Broken Access Control vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-31073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-09T13:48:35.471673Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-09T13:49:56.038Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-31073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-09T13:48:35.471673Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-09T13:48:37.822Z"}}], "cna": {"title": "WordPress Shortcode to display post and user data plugin <= 1.2.0 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Yuki Haruma | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Jose Vega", "product": "Display custom fields in the frontend \u2013 Post and User Profile Fields", "versions": [{"status": "affected", "changes": [{"at": "1.2.1", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.2.0"}], "packageName": "shortcode-to-display-post-and-user-data", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:35:11.488Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/shortcode-to-display-post-and-user-data/vulnerability/wordpress-shortcode-to-display-post-and-user-data-plugin-1-2-0-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend \u2013 Post and User Profile Fields shortcode-to-display-post-and-user-data allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend \u2013 Post and User Profile Fields: from n/a through <= 1.2.0.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend \u2013 Post and User Profile Fields shortcode-to-display-post-and-user-data allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Display custom fields in the frontend \u2013 Post and User Profile Fields: from n/a through <= 1.2.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T13:49:53.423Z"}}}, "cveMetadata": {"cveId": "CVE-2023-31073", "state": "PUBLISHED", "dateUpdated": "2026-04-23T13:49:53.423Z", "dateReserved": "2023-04-24T05:42:59.931Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2024-12-09T11:31:00.349Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "shortcode-to-display-post-and-user-data", "product": "Display custom fields in the frontend \u2013 Post and User Profile Fields", "vendor": "Jose Vega", "versions": [{"changes": [{"at": "1.2.1", "status": "unaffected"}], "lessThanOrEqual": "1.2.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend \u2013 Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend \u2013 Post and User Profile Fields: from n/a through 1.2.0."}, {"lang": "es", "value": "La vulnerabilidad de autorizaci\u00f3n faltante en Jose Vega Display custom fields in the frontend \u2013 Post and User Profile Fields permite explotar los niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Display custom fields in the frontend \u2013 Post and User Profile Fields: desde n/a hasta 1.2.0."}], "id": "CVE-2023-31073", "lastModified": "2026-06-17T05:56:13.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-31073", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-12-09T13:48:35.471673Z", "version": "2.0.3"}}]}, "published": "2024-12-09T13:15:28.540", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/shortcode-to-display-post-and-user-data/vulnerability/wordpress-shortcode-to-display-post-and-user-data-plugin-1-2-0-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{}