CVE-2023-3244
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to and including 1.2.0. This allows authenticated attackers with minimal permissions, such as a subscriber, to reset the plugin's settings.
Risk Assessment
Attackers can change the plugin's settings, potentially leading to unauthorized access to functions or data within the WordPress system. This poses a risk to the integrity and security of the website.
Recommendation
It is recommended to update the plugin to the latest version to eliminate this vulnerability. Additionally, conducting a user permissions audit to restrict access to sensitive functions is advisable.
Original NVD description (English source)
The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to reset the plugin's settings. NOTE: this issue is was only partially patched in version 1.2.0, as the nonce is still present to subscriber-level users.