10Web AI Assistant Plugin up to 1.0.18 on WordPress Plugin Installation authorization

Summaryinfo

A vulnerability classified as critical has been found in 10Web AI Assistant Plugin up to 1.0.18 on WordPress. This affects an unknown part of the component Plugin Installation Handler. Performing a manipulation results in authorization. This vulnerability is identified as CVE-2023-6985. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in 10Web AI Assistant Plugin up to 1.0.18 on WordPress (WordPress Plugin). This affects some unknown processing of the component Plugin Installation Handler. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.

The weakness was released 01/26/2024. It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2023-6985 since 12/20/2023. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/11/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• 10Web

Name

• AI Assistant Plugin

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion