CVE-2023-5559

10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.

Affected

10Web Booster

CVSS v3.1 NVD

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

2.79% chance of exploitation in the next 30 days, 86th percentile

Nuclei

critical

Published

2023-11-27

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/eba46f7d-e4db-400c-8032-015f21087bbf

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5559.yaml

References

• CVE Record
• NVD entry