CVE-2023-6959

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6959
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the recaptcha_api_key_manage function in all versions up to, and including, 2.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete the 'Recaptcha Site Key' and 'Recaptcha Secret Key' settings.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3022982 Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/774c00fb-82cd-44ca-bf96-3f6dfd1977d0?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:motopress:getwid_-_gutenberg_blocks:*:*:*:*:*:wordpress:*:*
History

14 Feb 2024, 17:01

Type Values Removed Values Added
CWE CWE-862
First Time Motopress
Motopress getwid - Gutenberg Blocks
References () https://plugins.trac.wordpress.org/changeset/3022982 - () https://plugins.trac.wordpress.org/changeset/3022982 - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/774c00fb-82cd-44ca-bf96-3f6dfd1977d0?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/774c00fb-82cd-44ca-bf96-3f6dfd1977d0?source=cve - Third Party Advisory
CPE cpe:2.3:a:motopress:getwid_-_gutenberg_blocks:*:*:*:*:*:wordpress:*:*
Summary
  • (es) El complemento Getwid – Gutenberg Blocks para WordPress es vulnerable a modificaciones no autorizadas de datos debido a una falta de verificación de capacidad en la función recaptcha_api_key_manage en todas las versiones hasta la 2.0.3 incluida. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, agreguen, modifiquen o eliminen las configuraciones de 'Clave de sitio de Recaptcha' y 'Clave secreta de Recaptcha'.

05 Feb 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-05 22:15

Updated : 2024-02-14 17:01

NVD link : CVE-2023-6959

Mitre link : CVE-2023-6959

CVE.ORG link : CVE-2023-6959

JSON object : View

Products Affected

motopress

  • getwid_-_gutenberg_blocks
CWE
CWE-862

Missing Authorization