CVE-2023-4209

The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as reset the plugin's settings and update its API key via CSRF attacks.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/b2c6fa7d-1b0f-444b-8ca5-8c1c06cea1d9	Exploit Third Party Advisory
https://wpscan.com/vulnerability/b2c6fa7d-1b0f-444b-8ca5-8c1c06cea1d9	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:poeditor:poeditor:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 08:34

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress POEditor anterior a la versión 0.9.8 no tiene comprobaciones CSRF en varios lugares, lo que podría permitir a los atacantes hacer que los administradores registrados realicen acciones no deseadas, como restablecer la configuración del plugin y actualizar su clave de API a través de ataques CSRF.
References	~~() https://wpscan.com/vulnerability/b2c6fa7d-1b0f-444b-8ca5-8c1c06cea1d9 - Exploit, Third Party Advisory~~	() https://wpscan.com/vulnerability/b2c6fa7d-1b0f-444b-8ca5-8c1c06cea1d9 - Exploit, Third Party Advisory

Information

Published : 2023-08-30 15:15

Updated : 2025-04-23 17:16

NVD link : CVE-2023-4209

Mitre link : CVE-2023-4209

CVE.ORG link : CVE-2023-4209

JSON object : View

Products Affected

poeditor

poeditor

CWE

No CWE.

{"id": "CVE-2023-4209", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-08-30T15:15:10.047", "references": [{"url": "https://wpscan.com/vulnerability/b2c6fa7d-1b0f-444b-8ca5-8c1c06cea1d9", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/b2c6fa7d-1b0f-444b-8ca5-8c1c06cea1d9", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "descriptions": [{"lang": "en", "value": "The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as reset the plugin's settings and update its API key via CSRF attacks."}, {"lang": "es", "value": "El plugin de WordPress POEditor anterior a la versi\u00f3n 0.9.8 no tiene comprobaciones CSRF en varios lugares, lo que podr\u00eda permitir a los atacantes hacer que los administradores registrados realicen acciones no deseadas, como restablecer la configuraci\u00f3n del plugin y actualizar su clave de API a trav\u00e9s de ataques CSRF."}], "lastModified": "2025-04-23T17:16:41.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:poeditor:poeditor:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "F10661B0-9B0A-4431-A499-C8275A6D6506", "versionEndExcluding": "0.9.8"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}