Vulnerability · Published Nov 30, 2023 · Assigned by Patchstack

CVE-2023-37890WordPress KB Support Plugin <= 1.5.88 is vulnerable to Broken Access Control

Medium 4.3

In plain English

A medium-severity missing authorization in KB Support – WordPress Help Desk and Knowledge Base from WPOmnia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 56.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88.

Affected products (as reported)

Vendor	Product	Versions
WPOmnia	KB Support – WordPress Help Desk and Knowledge Base	n/a – through 1.5.88

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://patchstack.com/database/vulnerability/kb-support/wordpress-kb-support-wordpress-help-desk-plugin-1-5-88-sensitive-data-exposure-vulnerability?_s_id=cve vdb-entry