CVE-2023-5509: myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion
Published Nov 20, 2023
·Updated
The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.
Affected Software
1 affected component
Premio Mystickymenu Wordpress<2.6.5
Event History
Nov 20, 2023
CVE Published
06:55 PM
Data Sourced
06:55 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-5509.
2
What is the severity of CVE-2023-5509?
The severity of CVE-2023-5509 is medium, with a severity keyword of 'medium' and a severity value of 5.4.
3
What is affected by CVE-2023-5509?
The myStickymenu WordPress plugin before version 2.6.5 is affected by CVE-2023-5509.
4
What does CVE-2023-5509 allow an attacker to do?
CVE-2023-5509 allows any logged-in user to perform unauthorized actions, such as deleting arbitrary form leads, due to inadequate authorization of some ajax calls.
5
Is there a fix available for CVE-2023-5509?
The fix for CVE-2023-5509 is to update the myStickymenu plugin to version 2.6.5 or later.