Vulnerability · Published Nov 17, 2023 · Assigned by Patchstack
CVE-2023-47757WordPress AWeber Plugin <= 7.3.9 is vulnerable to Broken Access Control
Medium 4.3
In plain English
A medium-severity missing authorization in AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth from AWeber. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth: from n/a through 7.3.9.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AWeber | AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth | n/a – through 7.3.9 |
Weakness: CWE-862, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N