CVE-2023-6966

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6966
The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.5.20. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:themoneytizer:the_moneytizer:*:*:*:*:*:wordpress:*:*
History

21 Nov 2024, 08:44

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php - Patch () https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve - Third Party Advisory

15 Jul 2024, 18:55

Type Values Removed Values Added
CWE CWE-862
References () https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php - () https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve - Third Party Advisory
CPE cpe:2.3:a:themoneytizer:the_moneytizer:*:*:*:*:*:wordpress:*:*
First Time Themoneytizer the Moneytizer
Themoneytizer

06 Jun 2024, 14:17

Type Values Removed Values Added
Summary
  • (es) El complemento The Moneytizer para WordPress es vulnerable al acceso no autorizado a datos, modificación de datos y pérdida de datos debido a una falta de verificación de capacidad en múltiples funciones AJAX en el archivo /core/core_ajax.php en todas las versiones hasta, e incluyendo, 9.5.20. Esto hace posible que atacantes autenticados, con acceso de suscriptor y superior, actualicen y recuperen detalles bancarios y de facturación, actualicen y restablezcan la configuración del complemento y actualicen idiomas, así como otras acciones de menor gravedad.

06 Jun 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-06 02:15

Updated : 2024-11-21 08:44

NVD link : CVE-2023-6966

Mitre link : CVE-2023-6966

CVE.ORG link : CVE-2023-6966

JSON object : View

Products Affected

themoneytizer

  • the_moneytizer
CWE
CWE-862

Missing Authorization