Vulnerability · Published Dec 18, 2023 · Assigned by WPScan
CVE-2023-6077Slider - Ultimate Responsive Image Slider < 3.5.12 - Subscriber+ Arbitrary Post Access
Medium 6.5
In plain English
A medium-severity security flaw in Slider from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.7%top 48.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
Affected products (as reported)
References
- https://wpscan.com/vulnerability/1afc0e4a-f712-47d4-bf29-7719ccbbbb1b exploit, vdb-entry, technical-description