Simple Blog Card Plugin up to 1.31 on WordPress authorization

Summaryinfo

A vulnerability labeled as problematic has been found in Simple Blog Card Plugin up to 1.31 on WordPress. The affected element is an unknown function. The manipulation results in authorization. This vulnerability is reported as CVE-2023-4036. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Simple Blog Card Plugin up to 1.31 on WordPress (Blog Software). Affected is an unknown part. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality. CVE summarizes:

The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones

The weakness was disclosed 08/30/2023. The advisory is shared for download at wpscan.com. This vulnerability is traded as CVE-2023-4036 since 08/01/2023. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.32 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Blog Software

Name

• Simple Blog Card Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion