CVE-2023-2280 - WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action

Back Back to CVE browser

MEDIUM

WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action

Published Jun 9, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0 and an additional partial patch was introduced in version 1.2.2, but the issue was not fully patched until 1.2.3.

Affected products

Vendor Wpdirectorykit Product WP Directory Kit Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=1.2.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wpdirectorykit

WP Directory Kit

unaffected

Version	Status	Constraints
0	affected	<=1.2.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33786		Advisory
https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.1.8/public/class-wpdirectorykit-public.php#L249		Patch
https://plugins.trac.wordpress.org/changeset/2907164/		Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/abb1a758-5c16-4841-b1c7-0705ab16b328?source=cve		Third Party Advisory