CVE-2023-6029

EazyDocs < 2.3.6 - Unauthenticated Arbitrary Posts Deletion and Document Management

The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections.

Affected

EazyDocs

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 15th percentile

Published

2024-01-15

Updated

2025-06-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e

References

• CVE Record
• NVD entry