Vulnerability · Published May 15, 2025 · Assigned by WPScan
CVE-2023-7239wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR
High 7.5
In plain English
A high-severity security flaw in WP Dashboard Notes from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 53.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Dashboard Notes | 0 – before 1.0.11 |
References
- https://wpscan.com/vulnerability/6e6afe50-27f9-41fa-a94b-f44df0850e2c/ exploit, vdb-entry, technical-description