Vulnerability · Published Aug 31, 2023 · Assigned by Wordfence

CVE-2023-2353CHP Ads Block Detector <= 3.9.4 - Missing Authorization to Plugin Settings Update

Medium 4.3

In plain English

A medium-severity missing authorization in CHP Ads Block Detector from sureshchand12a. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 56.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd_action function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to change or reset plugin settings. CVE-2023-36509 appears to be a duplicate of this issue.

Affected products (as reported)

Vendor	Product	Versions
sureshchand12a	CHP Ads Block Detector	0 – through 3.9.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References