CVE-2023-7019 - LightStart – Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8

Back Back to CVE browser

MEDIUM

LightStart – Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8 - Missing Authorization

Published Jan 11, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 0.32%

Description

The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to change page designs.

Affected products

Vendor Themeisle Product LightStart – Maintenance Mode, Coming Soon and Landing Page Builder Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=2.6.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Themeisle

LightStart – Maintenance Mode, Coming Soon and Landing Page Builder

unaffected

Version	Status	Constraints
0	affected	<=2.6.8

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59210		Advisory
https://plugins.trac.wordpress.org/changeset/3013229/wp-maintenance-mode/trunk/includes/classes/wp-maintenance-mode-admin.php?contextall=1&old=2922691&old_path=%2Fwp-maintenance-mode%2Ftrunk%2Fincludes%2Fclasses%2Fwp-maintenance-mode-admin.php		Issue Tracking
https://www.wordfence.com/threat-intel/vulnerabilities/id/b57d3d1d-dcdb-4f11-82d8-183778baa075?source=cve		Third Party Advisory