CVE-2023-3601 : The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that us

The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.

Published 2023-08-14 20:15:12

Updated 2023-08-21 16:05:16

Source WPScan

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2023-3601

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 24 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-3601

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-3601

CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Assigned by: contact@wpscan.com (Primary)

Products affected by CVE-2023-3601

Webfactoryltd » Simple Author Box » For Wordpress
Versions before (<) 2.52
cpe:2.3:a:webfactoryltd:simple_author_box:*:*:*:*:*:wordpress:*:*
Matching versions

Vulnerability Details : CVE-2023-3601

Exploit prediction scoring system (EPSS) score for CVE-2023-3601

CVSS scores for CVE-2023-3601

CWE ids for CVE-2023-3601

References for CVE-2023-3601

Products affected by CVE-2023-3601