CVE-2023-0447 - My YouTube Channel <= 3.0.12.1 - Missing Authorization

Back Back to CVE browser

MEDIUM

My YouTube Channel <= 3.0.12.1 - Missing Authorization

Published Jan 23, 2023

4.3

MEDIUM

CVSS 3.1

EPSS 0.59%

Description

The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions up to, and including, 3.0.12.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to clear the plugin's cache.

Affected products

Vendor Urkekg Product My YouTube Channel Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=3.0.12.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Urkekg

My YouTube Channel

unaffected

Version	Status	Constraints
-	affected	<=3.0.12.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (5)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-12501		Advisory
https://plugins.trac.wordpress.org/browser/youtube-channel/trunk/youtube-channel.php?rev=2482795#L1502		Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2844200%40youtube-channel&new=2844200%40youtube-channel&sfp_email=&sfph_mail=		PatchThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/486b6a75-d101-4f3a-8436-6c23dd0ff200		Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/486b6a75-d101-4f3a-8436-6c23dd0ff200?source=cve