CVE-2023-2764: Draw Attention <= 2.0.11 - Missing Authorization to Arbitrary Post Featured Image Modification
The Draw Attention plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsetfeaturedimage function in versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the featured image of arbitrary posts with an image that exists in the media library.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2764?
CVE-2023-2764 has a medium severity rating, allowing authenticated attackers to modify data due to the absence of a capability check.
How do I fix CVE-2023-2764?
To fix CVE-2023-2764, update the Draw Attention plugin to version 2.0.12 or later.
Who is affected by CVE-2023-2764?
CVE-2023-2764 affects users of the Draw Attention plugin for WordPress versions up to and including 2.0.11.
What functionality does CVE-2023-2764 compromise?
CVE-2023-2764 compromises the ajax_set_featured_image function, allowing unauthorized image modifications.
Can unprivileged users exploit CVE-2023-2764?
No, CVE-2023-2764 requires authenticated users with subscriber-level permissions to exploit the vulnerability.