CVE-2023-6029

EazyDocs < 2.3.6 - Unauthenticated Arbitrary Posts Deletion and Document Management

High · published January 15, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.2th percentile
Published
2024-01-15T15:10Z
EPSS history
Timeline
  • 15 JAN 15:10Z
    EazyDocs < 2.3.6 - Unauthenticated Arbitrary Posts Deletion and Document Management
    cvelistv5