1. Home
  2. CVE Database
  3. CVE-2023-0328
MEDIUM · 4.3

CVE-2023-0328

The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can ed...

Vulnerability Description

The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
WpcodeWpcode< 2.0.7

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2023-0328?

CVE-2023-0328 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can ed...

How severe is CVE-2023-0328?

CVE-2023-0328 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-0328?

Check the references section above for vendor advisories and patch information. Affected products include: Wpcode Wpcode.