CVE-2023-4024: Radio Player <= 2.0.73 - Missing Authorization to Player Deletion
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteplayer function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to delete player instances.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4024?
CVE-2023-4024 has a medium severity level due to the potential for unauthorized deletion of player instances.
How do I fix CVE-2023-4024?
To fix CVE-2023-4024, update the Radio Player plugin for WordPress to version 2.0.74 or later.
What are the affected versions of the Radio Player plugin for CVE-2023-4024?
The affected versions of the Radio Player plugin for CVE-2023-4024 are up to and including 2.0.73.
What type of attack is possible with CVE-2023-4024?
CVE-2023-4024 allows unauthenticated attackers to delete player instances due to a missing capability check.
Is the Radio Player plugin for WordPress secure after the fix for CVE-2023-4024?
Yes, after updating to version 2.0.74 or later, the Radio Player plugin for WordPress addresses the vulnerability and enhances security.