CVE-2023-6279
Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS
- State
- Published
- Severity
- 7.1 High
- Published
- Jan 29, 2024
- Updated
- Jun 2, 2025
- Reserved
- Nov 24, 2023
Description
The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Woostify Sites LibraryUnknown |
|
References
- https://wpscan.com/vulnerability/626bbc7d-0d0f-4418-ac61-666278a1cbdb/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.