VulnerabilityModified
CVE-2023-6633
The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks
MEDIUM 4.3EPSS 0.22%
Does this matter?
Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.
Description
The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- EPSS
- 0.22% probability · 12th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- sidenotesproject/side notes
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/eb983d82-b894-41c5-b51f-94d4bba3ba39/Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/eb983d82-b894-41c5-b51f-94d4bba3ba39/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.