Lucene search

WordfenceCVE-2023-6369

HistoryJan 11, 2024 - 9:15 a.m.

CVE-2023-6369

2024-01-1109:15:48

CWE-862

Wordfence

web.nvd.nist.gov

cve-2023-6369

vulnerability

wordpress

plugin

data access

data modification

ajax actions

nvd

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

31.0%

JSON

The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 2.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose sensitive information or perform unauthorized actions, such as saving advanced plugin settings.

Affected configurations

Nvd

Vulners

Node

myrecorpexport_wp_page_to_static_html\/cssRange≤2.1.9wordpress

VendorProductVersionCPE
myrecorpexport_wp_page_to_static_html\/css*cpe:2.3:a:myrecorp:export_wp_page_to_static_html\/css:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
myrecorp	export_wp_page_to_static_html\/css	*	cpe:2.3:a:myrecorp:export_wp_page_to_static_html\/css::::::wordpress::*

CNA Affected

[
  {
    "vendor": "recorp",
    "product": "Export WP Page to Static HTML/CSS",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.1.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/cancelRcExportProcess.php#L23

plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/deleteExportedZipFile.php#L24

plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/exportLogPercentage.php#L23

plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/requestForWpPageToStaticHtml.php#L24

plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/saveAdvancedSettings.php#L22

plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/searchPosts.php#L24

plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/includes/AjaxRequests/seeLogsInDetails.php#L22

plugins.trac.wordpress.org/changeset/3002740/export-wp-page-to-static-html

www.wordfence.com/threat-intel/vulnerabilities/id/47cb48aa-b556-4f25-ac68-ff0a812972c1?source=cve

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

31.0%

JSON

Related for CVE-2023-6369