CVE-2023-3052: Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Post Creation/Modification/Deletion
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azhaddpost', 'azhduplicatepost', 'azhupdatepost' and 'azhremovepost' functions. This makes it possible for unauthenticated attackers to create, modify, and delete a post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3052?
CVE-2023-3052 is classified as a moderate severity vulnerability due to the potential impact of Cross-Site Request Forgery.
How do I fix CVE-2023-3052?
To fix CVE-2023-3052, you should update the Page Builder by AZEXO plugin to version 1.27.134 or later, which includes the necessary nonce validation.
Which versions of the Page Builder by AZEXO plugin are affected by CVE-2023-3052?
CVE-2023-3052 affects versions of the Page Builder by AZEXO plugin up to and including 1.27.133.
What are the functions involved in CVE-2023-3052?
The functions involved in CVE-2023-3052 are 'azh_add_post', 'azh_duplicate_post', 'azh_update_post', and 'azh_remove_post'.
What type of attack does CVE-2023-3052 expose users to?
CVE-2023-3052 exposes users to Cross-Site Request Forgery (CSRF) attacks due to missing nonce validation.