CVE-2023-5644

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e	Exploit Third Party Advisory
https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wpvibes:wp_mail_log:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 08:42

Type	Values Removed	Values Added
References	~~() https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e - Exploit, Third Party Advisory

04 Jan 2024, 17:12

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.6
CPE		cpe:2.3:a:wpvibes:wp_mail_log::::::wordpress::*
References	~~() https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e -~~	() https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e - Exploit, Third Party Advisory
CWE		CWE-863

26 Dec 2023, 20:34

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-26 19:15

Updated : 2024-11-21 08:42

NVD link : CVE-2023-5644

Mitre link : CVE-2023-5644

CVE.ORG link : CVE-2023-5644

JSON object : View

Products Affected

wpvibes

wp_mail_log

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2023-5644", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2023-12-26T19:15:07.843", "references": [{"url": "https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users."}, {"lang": "es", "value": "El complemento WP Mail Log WordPress anterior a 1.1.3 no autoriza correctamente sus endpoint de API REST, lo que permite a los usuarios con el rol de Colaborador ver y eliminar datos a los que solo deber\u00edan tener acceso los usuarios administradores."}], "lastModified": "2024-11-21T08:42:11.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wpvibes:wp_mail_log:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "0DB6599D-1AF5-4662-B350-8389E2D4988E", "versionEndExcluding": "1.1.3"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}