CVE-2023-41954

HIGHNuclei

WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-41954 has a selected CVSS score of 8.6 (high); EIP currently links 1 Nuclei template.

Description

Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 12, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 17, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

ProfilePress

Browse ProfilePress Membership Team / ProfilePresswp-user-avatar

Default status: unaffected

CVE ListThrough 4.13.1affected

ProfilePress Plugin

Browse ProfilePress Membership Team / ProfilePress Plugin
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryHIGHProfilePress <= 4.13.1 — Unauthenticated Privilege EscalationCVSS 8.6

Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1.

Impact

Attackers can escalate privileges, gaining unauthorized access to restricted features or data within ProfilePress.

Remediation

Update to the latest version of ProfilePress to address privilege management issues.

WeaknessesCWE-269
Authorsdaffainfo
Template tagscvecve2023wordpresswpwp-pluginproperfractionprofilepressvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CPE: cpe:2.3:a:properfraction:profilepress:*:*:*:*:*:wordpress:*:*
Shodan: http.component:"profilepress"
FOFA: body="/wp-content/plugins/wp-user-avatar/"
https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-13-1-unauthenticated-limited-privilege-escalation-vulnerability?_s_id=cve https://infosecwriteups.com/cve-2023-41954-profilepress-4-13-1-unauthenticated-privilege-escalation-fa781b778d59 https://nvd.nist.gov/vuln/detail/CVE-2023-41954

Source: ProjectDiscovery

References

2