CVE-2023-0336

The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

1.00% chance of exploitation in the next 30 days, 61th percentile

Published

2023-03-27

Updated

2025-02-19

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ac74df9a-6fbf-4411-a501-97eba1ad1895

References

• CVE Record
• NVD entry

Related

• CVE-2023-0335
• CVE-2023-0340
• CVE-2023-0334
• CVE-2023-0341
• CVE-2023-0333
• CVE-2023-0342