CVE-2023-0335
WP Shamsi <= 4.3.3 - Subscriber+ Attachment Deletion
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.5EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
27 Mar 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · WP ShamsiWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →