CVE-2023-5251: Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete
The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'gridplussavelayoutcallback' and 'gridplusdeletecallback' functions in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with subscriber privileges or above, to add, update or delete grid layout. CVE-2023-34014 appears to be a duplicate of this issue.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the Grid Plus plugin for WordPress?
The vulnerability ID for the Grid Plus plugin for WordPress is CVE-2023-5251.
What is the severity of CVE-2023-5251?
The severity of CVE-2023-5251 is medium with a CVSS score of 5.4.
Which version of the Grid Plus plugin for WordPress is affected by CVE-2023-5251?
Versions up to and including 1.3.2 of the Grid Plus plugin for WordPress are affected by CVE-2023-5251.
What is the impact of CVE-2023-5251?
CVE-2023-5251 can result in unauthorized modification of data and loss of data.
How can I fix CVE-2023-5251?
To fix CVE-2023-5251, update the Grid Plus plugin for WordPress to a version higher than 1.3.2.