CVE-2023-4282
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The EmbedPress plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to and including 3.8.2. This allows authenticated attackers with subscriber privileges or above to delete plugin settings.
Risk Assessment
The organization may lose important configuration data for the plugin, potentially leading to disruptions in website functionality or loss of features.
Recommendation
It is recommended to update the EmbedPress plugin to the latest version to mitigate this vulnerability and implement additional capability checks for functions related to data removal.
Other vulnerabilities in EmbedPress plugin for WordPress
See all- CVE-2023-4283Medium
The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'embedpress_calendar' shortcode in versions up to and including 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes.
- CVE-2023-3371Medium
The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key in the 'lock_content_form_handler' and 'display_password_form' functions in versions up to and including 3.7.3. This allows unauthenticated attackers to decrypt and view password protected content.
Original NVD description (English source)
The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete plugin settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS