CVE-2023-5644

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e	Exploit Third Party Advisory
https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wpvibes:wp_mail_log:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2023-12-26 19:15

Updated : 2024-11-21 08:42

NVD link : CVE-2023-5644

Mitre link : CVE-2023-5644

CVE.ORG link : CVE-2023-5644

JSON object : View

Products Affected

wpvibes

wp_mail_log

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2023-5644", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2023-12-26T19:15:07.843", "references": [{"url": "https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users."}, {"lang": "es", "value": "El complemento WP Mail Log WordPress anterior a 1.1.3 no autoriza correctamente sus endpoint de API REST, lo que permite a los usuarios con el rol de Colaborador ver y eliminar datos a los que solo deber\u00edan tener acceso los usuarios administradores."}], "lastModified": "2024-11-21T08:42:11.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wpvibes:wp_mail_log:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "0DB6599D-1AF5-4662-B350-8389E2D4988E", "versionEndExcluding": "1.1.3"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}