The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the contents of the .htaccess files located in a site's root directory or /wp-content and /wp-includes folders and achieve remote code execution.
References
Link | Resource |
---|---|
https://giongfnef.gitbook.io/giongfnef/cve/cve-2023-5311 | Exploit Third Party Advisory |
https://plugins.trac.wordpress.org/changeset/2977703/wp-extra | Patch |
https://www.wordfence.com/threat-intel/vulnerabilities/id/87e3dd5e-0d77-4d78-8171-0beaf9482699?source=cve | Patch Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-10-25T07:36:02.737Z
Updated: 2023-10-25T07:36:02.737Z
Reserved: 2023-09-29T18:45:02.146Z
Link: CVE-2023-5311
JSON object: View
NVD Information
Status : Modified
Published: 2023-10-25T18:17:43.497
Modified: 2023-11-07T04:23:52.753
Link: CVE-2023-5311
JSON object: View
Redhat Information
No data.
CWE