CVE-2023-5559

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

2.79% chance of exploitation in the next 30 days, 85th percentile

Nuclei

critical

Published

2023-11-27

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/eba46f7d-e4db-400c-8032-015f21087bbf

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5559.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2023-5558
• CVE-2023-5560
• CVE-2023-5556
• CVE-2023-5561
• CVE-2023-5555
• CVE-2023-5564