CVE-2023-1597: tagDiv Cloud Library < 2.7 - Unauthenticated Arbitrary User Metadata Update to Privilege Escalation
Published Jul 10, 2023
·Updated
The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.
Affected Software
1 affected component
tagDiv Cloud Library WordPress<2.7
Event History
Jul 10, 2023
CVE Published
via MITRE·12:40 PM
Data Sourced
via MITRE·12:40 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-1597.
2
What is the severity of CVE-2023-1597?
CVE-2023-1597 has a severity rating of 8.8, which is classified as high.
3
What is the affected software?
The affected software is the tagDiv Cloud Library WordPress plugin before version 2.7.
4
What can an unauthenticated user do with this vulnerability?
An unauthenticated user can change arbitrary user metadata, which could lead to privilege escalation.
5
Is there a fix for CVE-2023-1597?
Yes, updating the tagDiv Cloud Library WordPress plugin to version 2.7 or later fixes the vulnerability.