{"id":"CVE-2023-0551","state":"PUBLISHED","title":"REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion","description":"The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments","publishedAt":"2023-08-16T11:03:30.386Z","updatedAt":"2024-10-08T19:13:55.458Z","severity":null,"assigner":"WPScan","products":["Unknown REST API TO MiniProgram"],"affected":[{"vendor":"Unknown","product":"REST API TO MiniProgram","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.6.1","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/0xxx/CVE-2023-0551.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-0551","state":"PUBLISHED","datePublished":"2023-08-16T11:03:30.386Z","dateUpdated":"2024-10-08T19:13:55.458Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2023-01-27T19:20:34.011Z"},"containers":{"cna":{"title":"REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment Deletion","descriptions":[{"lang":"en","value":"The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments"}],"affected":[{"vendor":"Unknown","product":"REST API TO MiniProgram","defaultStatus":"affected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.6.1","versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]},{"descriptions":[{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2023-08-16T11:03:30.386Z"},"credits":[{"lang":"en","value":"Lana Codes","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T05:17:49.679Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-08T19:13:49.169916Z","id":"CVE-2023-0551","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-08T19:13:55.458Z"}}]}}}