CVE-2023-6985: 10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation
The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the installplugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6985?
CVE-2023-6985 is classified as a high severity vulnerability due to the potential for unauthorized data modification.
How do I fix CVE-2023-6985?
To fix CVE-2023-6985, update the 10Web AI Assistant plugin to version 1.0.19 or higher.
Who is affected by CVE-2023-6985?
CVE-2023-6985 affects all versions of the 10Web AI Assistant plugin for WordPress up to and including 1.0.18.
What is the impact of CVE-2023-6985?
The impact of CVE-2023-6985 allows authenticated attackers to modify plugin data without proper permissions.
Is CVE-2023-6985 exploitable remotely?
CVE-2023-6985 requires the attacker to be authenticated, making it less likely to be exploited remotely.