CVE-2023-6751: Hostinger <= 1.9.7 - Missing Authorization to Maintenance Mode Activation

Q: What is the severity of CVE-2023-6751?

CVE-2023-6751 is categorized as a high severity vulnerability due to its potential for unauthorized changes to critical plugin settings.

Q: How do I fix CVE-2023-6751?

To fix CVE-2023-6751, update the Hostinger plugin for WordPress to the latest version beyond 1.9.7.

Q: Who is affected by CVE-2023-6751?

All users of the Hostinger plugin for WordPress versions up to and including 1.9.7 are affected by CVE-2023-6751.

Q: What kind of attack is possible with CVE-2023-6751?

CVE-2023-6751 allows unauthenticated attackers to enable or disable maintenance mode on compromised WordPress sites.

Q: Is there a workaround for CVE-2023-6751?

There is no documented workaround for CVE-2023-6751; updating the plugin is the recommended action.

Published Jan 11, 2024

Updated

The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publishwebsite in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.

Affected Software

1 affected component

Hostinger Hostinger Wordpress<=1.9.7

Remediation

Patch Available

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010008%40hostinger%2Ftrunk&old=3010004%40hostinger%2Ftrunk&sfp_email=&sfph_mail=

Event History

Jan 11, 2024

CVE Published

via MITRE·08:33 AM

Data Sourced

via MITRE·08:33 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-6751?

CVE-2023-6751 is categorized as a high severity vulnerability due to its potential for unauthorized changes to critical plugin settings.

How do I fix CVE-2023-6751?