CVE-2023-0749: Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-0749?
CVE-2023-0749 is a vulnerability in the Ocean Extra WordPress plugin that allows authenticated users to retrieve the content of arbitrary posts.
How does CVE-2023-0749 affect Ocean Extra WordPress plugin?
CVE-2023-0749 affects Ocean Extra WordPress plugin versions up to and including 2.1.3.
What is the severity of CVE-2023-0749?
The severity of CVE-2023-0749 is medium with a CVSS score of 6.5.
How can an authenticated user exploit CVE-2023-0749?
An authenticated user, such as a subscriber, can exploit CVE-2023-0749 to retrieve the content of arbitrary posts, including draft, private, or password protected ones.
Is there a fix available for CVE-2023-0749?
Yes, updating Ocean Extra WordPress plugin to version 2.1.4 or later fixes CVE-2023-0749 vulnerability.