CVE-2023-0551

REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion

The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments

Affected

REST API TO MiniProgram

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS

0.28% chance of exploitation in the next 30 days, 19th percentile

Published

2023-08-16

Updated

2024-10-08

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d

References

• CVE Record
• NVD entry