CVE-2023-4025: Radio Player <= 2.0.73 - Missing Authorization to Player Update
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateplayer function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4025?
CVE-2023-4025 is classified as a high severity vulnerability due to the potential for unauthorized data modification.
What versions are affected by CVE-2023-4025?
CVE-2023-4025 affects all versions of the Radio Player plugin for WordPress up to and including 2.0.73.
How do I fix CVE-2023-4025?
To fix CVE-2023-4025, upgrade the Radio Player plugin to version 2.0.74 or later.
What kind of attacks are possible with CVE-2023-4025?
CVE-2023-4025 allows unauthenticated attackers to modify player instances through the update_player function.
Is authentication required to exploit CVE-2023-4025?
No, exploitation of CVE-2023-4025 does not require user authentication.