CVE-2023-0551

The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS

0.28% chance of exploitation in the next 30 days, 20th percentile

Published

2023-08-16

Updated

2024-10-08

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d

References

• CVE Record
• NVD entry

Related

• CVE-2023-0549
• CVE-2023-0552
• CVE-2023-0548
• CVE-2023-0559
• CVE-2023-0546
• CVE-2023-0560