Vulnerability Description
The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'. It also unserializes user input in the process, which may lead to Object Injection attacks.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kutethemes | Ovic Responsive Wpbakery | < 1.2.9 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/35c9a954-37fc-4818-a71f-34aaaa0fa3dbThird Party Advisory
- https://wpscan.com/vulnerability/35c9a954-37fc-4818-a71f-34aaaa0fa3dbThird Party Advisory
FAQ
What is CVE-2023-5235?
CVE-2023-5235 is a vulnerability with a CVSS score of 8.8 (HIGH). The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog...
How severe is CVE-2023-5235?
CVE-2023-5235 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-5235?
Check the references section above for vendor advisories and patch information. Affected products include: Kutethemes Ovic Responsive Wpbakery.