CVE-2023-4282: EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data
The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'adminpostremove' and 'removeprivatedata' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete plugin settings.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4282?
CVE-2023-4282 is a vulnerability in the EmbedPress plugin for WordPress that allows authenticated attackers with subscriber privileges or above to cause unauthorized loss of data.
What is the severity of CVE-2023-4282?
The severity of CVE-2023-4282 is medium with a CVSS score of 4.3.
How does CVE-2023-4282 occur?
CVE-2023-4282 occurs due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in the EmbedPress plugin for WordPress.
Which versions of the EmbedPress plugin are affected by CVE-2023-4282?
Versions up to and including 3.8.2 of the EmbedPress plugin for WordPress are affected by CVE-2023-4282.
How can I fix or mitigate CVE-2023-4282?
To fix CVE-2023-4282, it is recommended to update to a version of the EmbedPress plugin for WordPress that is not affected by the vulnerability.