The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.
References
Configurations
History
21 Nov 2024, 08:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Health.php - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/a77d0fb5-8829-407d-a40a-169cf0c5f837?source=cve - Third Party Advisory |
14 Aug 2023, 15:27
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-863 | |
| CPE | cpe:2.3:a:full:full_-_customer:*:*:*:*:*:wordpress:*:* | |
| First Time |
Full full - Customer
Full |
|
| References | (MISC) https://plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Health.php - Product | |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/a77d0fb5-8829-407d-a40a-169cf0c5f837?source=cve - Third Party Advisory |
09 Aug 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-09 04:15
Updated : 2024-11-21 08:34
NVD link : CVE-2023-4242
Mitre link : CVE-2023-4242
CVE.ORG link : CVE-2023-4242
JSON object : View
Products Affected
full
- full_-_customer
CWE
CWE-863
Incorrect Authorization