CVE-2023-0328

WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion

published March 6, 2023

CVSS
—
EPSS
1%
Percentile
56.2
In the wild
Unconfirmed
What it is

The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00801 · 56.2th percentile
Published
2023-03-06T13:33Z
EPSS history
Timeline
  • 06 MAR 13:33Z
    WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion
    cvelistv5