Vulnerability Description
The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with subscriber privileges or above, to change user passwords and potentially take over administrator accounts.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Smartypantsplugins | Sp Project \& Document Manager | <= 4.67 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/clasPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc2e720-85d9-42d9-94eThird Party Advisory
- https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/clasPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc2e720-85d9-42d9-94eThird Party Advisory
FAQ
What is CVE-2023-3063?
CVE-2023-3063 is a vulnerability with a CVSS score of 8.8 (HIGH). The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due to the plugin providing user-controlled ac...
How severe is CVE-2023-3063?
CVE-2023-3063 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-3063?
Check the references section above for vendor advisories and patch information. Affected products include: Smartypantsplugins Sp Project \& Document Manager.