Vulnerabilities > CVE-2023-6279 - Missing Authorization vulnerability in Wootsify Sites Library

CVSS 7.1 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

HIGH

network

low complexity

wootsify

CWE-862

NVD

Published: 2024-01-29

Updated: 2024-02-03

Summary

The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name

Vulnerable Configurations

Part	Description	Count
Application	Wootsify Wootsify Sites Library 1.1.6 Wootsify Sites Library 1.1.7 Wootsify Sites Library 1.1.8 Wootsify Sites Library 1.1.9 Wootsify Sites Library 1.2.0 Wootsify Sites Library 1.2.1 Wootsify Sites Library 1.2.2 Wootsify Sites Library 1.2.3 Wootsify Sites Library 1.2.4 Wootsify Sites Library 1.2.5 Wootsify Sites Library 1.2.6 Wootsify Sites Library 1.2.7 Wootsify Sites Library 1.2.8 Wootsify Sites Library 1.2.9 Wootsify Sites Library 1.3.0 Wootsify Sites Library 1.3.1 Wootsify Sites Library 1.3.2 Wootsify Sites Library 1.3.3 Wootsify Sites Library 1.3.4 Wootsify Sites Library 1.3.5 Wootsify Sites Library 1.3.6 Wootsify Sites Library 1.3.8 Wootsify Sites Library 1.3.9 Wootsify Sites Library 1.4.0 Wootsify Sites Library 1.4.1 Wootsify Sites Library 1.4.2 Wootsify Sites Library 1.4.3 Wootsify Sites Library 1.4.4 Wootsify Sites Library 1.4.5 Wootsify Sites Library 1.4.6 Wootsify Sites Library 1.4.7	31

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

References

https://wpscan.com/vulnerability/626bbc7d-0d0f-4418-ac61-666278a1cbdb/