The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the recaptcha_api_key_manage function in all versions up to, and including, 2.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete the 'Recaptcha Site Key' and 'Recaptcha Secret Key' settings.
References
Link | Resource |
---|---|
https://plugins.trac.wordpress.org/changeset/3022982 | Patch |
https://www.wordfence.com/threat-intel/vulnerabilities/id/774c00fb-82cd-44ca-bf96-3f6dfd1977d0?source=cve | Third Party Advisory |
Configurations
History
14 Feb 2024, 17:01
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:motopress:getwid_-_gutenberg_blocks:*:*:*:*:*:wordpress:*:* | |
References | () https://plugins.trac.wordpress.org/changeset/3022982 - Patch | |
References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/774c00fb-82cd-44ca-bf96-3f6dfd1977d0?source=cve - Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
CWE | CWE-862 | |
First Time |
Motopress
Motopress getwid - Gutenberg Blocks |
05 Feb 2024, 22:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-02-05 22:15
Updated : 2024-02-28 20:54
NVD link : CVE-2023-6959
Mitre link : CVE-2023-6959
CVE.ORG link : CVE-2023-6959
JSON object : View
Products Affected
motopress
- getwid_-_gutenberg_blocks
CWE
CWE-862
Missing Authorization