CVE-2023-0443

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 47th percentile

Published

2023-05-30

Updated

2025-01-10

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/471f3226-8f90-43d1-b826-f11ef4bbd602

References

• CVE Record
• NVD entry

Related

• CVE-2023-0442
• CVE-2023-0448
• CVE-2023-0441
• CVE-2023-0453
• CVE-2023-0440
• CVE-2023-0455