CVE-2023-3053: Page Builder by AZEXO <= 1.27.133 - Missing Authorization to Post Creation
The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azhaddpost' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and post status.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/plugin/Page Builder by AZEXOto a version that resolves this vulnerability.Fixed in 1.27.133
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3053?
CVE-2023-3053 is considered a moderate severity vulnerability due to its potential for unauthorized data modification by authenticated attackers.
How do I fix CVE-2023-3053?
To fix CVE-2023-3053, update the Page Builder by AZEXO plugin to version 1.27.134 or later.
Who is affected by CVE-2023-3053?
CVE-2023-3053 affects users of the Page Builder by AZEXO plugin for WordPress in versions up to and including 1.27.133.
What type of attack is possible with CVE-2023-3053?
CVE-2023-3053 allows authenticated attackers to create posts of any post type due to a missing capability check.
When was CVE-2023-3053 disclosed?
CVE-2023-3053 was disclosed in 2023, highlighting a vulnerability in the Page Builder by AZEXO plugin.