CVE-2023-4293: Premium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalation
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmppupdateprofile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-4293?
CVE-2023-4293 has been classified as a privilege escalation vulnerability.
How do I fix CVE-2023-4293?
To fix CVE-2023-4293, update the Premium Packages - Sell Digital Products Securely plugin to version 5.7.5 or later.
Who is affected by CVE-2023-4293?
CVE-2023-4293 affects users of the Premium Packages - Sell Digital Products Securely plugin for WordPress versions up to and including 5.7.4.
Can unprivileged users exploit CVE-2023-4293?
Yes, authenticated attackers with minimal permissions can exploit CVE-2023-4293 due to insufficient restrictions on the affected function.
What functionality is compromised by CVE-2023-4293?
CVE-2023-4293 compromises the security of the 'wpdmpp_update_profile' function, allowing privilege escalation.