CVE-2023-4686: WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure
The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajaxenabledposts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4686?
CVE-2023-4686 is a vulnerability in the WP Customer Reviews plugin for WordPress that allows authenticated attackers to extract sensitive information, such as post titles and slugs.
What is the severity of CVE-2023-4686?
CVE-2023-4686 has a severity score of 4.3, which is considered medium.
How does CVE-2023-4686 occur?
CVE-2023-4686 occurs through the ajax_enabled_posts function in versions up to and including 3.6.6 of the WP Customer Reviews plugin for WordPress.
Can an attacker exploit CVE-2023-4686 remotely?
No, CVE-2023-4686 can only be exploited by authenticated attackers.
Is there a fix available for CVE-2023-4686?
Yes, you can update the WP Customer Reviews plugin to a version higher than 3.6.6 to mitigate the vulnerability.