CVE-2023-1624: WPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRF
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcodeactivatesnippets capability delete arbitrary log files on the server, including outside of the blog folders
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1624?
CVE-2023-1624 has a medium severity rating due to its potential for unauthorized file deletion.
How do I fix CVE-2023-1624?
To fix CVE-2023-1624, update the WPCode plugin to version 2.0.9 or later.
Who is affected by CVE-2023-1624?
Users of the WPCode WordPress plugin prior to version 2.0.9 are affected by CVE-2023-1624.
What does CVE-2023-1624 exploit?
CVE-2023-1624 exploits a CSRF vulnerability allowing users with specific capabilities to delete arbitrary log files.
What are the consequences of CVE-2023-1624?
The consequences of CVE-2023-1624 include the potential for attackers to delete critical log files from the server.