CVE-2023-5509

2023-11-2019:15:09

CWE-863

WPScan

web.nvd.nist.gov

cve-2023-5509

wordpress plugin

mystickymenu

authorization bypass

security vulnerability

nvd

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS

Percentile

13.3%

JSON

The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.

Affected configurations

Nvd

Vulners

Node

premiomystickymenuRange<2.6.5wordpress

VendorProductVersionCPE
premiomystickymenu*cpe:2.3:a:premio:mystickymenu:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
premio	mystickymenu	*	cpe:2.3:a:premio:mystickymenu::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "2.6.5"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]