1. Home
  2. CVE Database
  3. CVE-2023-5644
HIGH · 7.6

CVE-2023-5644

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Ad...

Vulnerability Description

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

CVSS Score

7.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
WpvibesWp Mail Log< 1.1.3

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2023-5644?

CVE-2023-5644 is a vulnerability with a CVSS score of 7.6 (HIGH). The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Ad...

How severe is CVE-2023-5644?

CVE-2023-5644 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-5644?

Check the references section above for vendor advisories and patch information. Affected products include: Wpvibes Wp Mail Log.