by Kastro
Paper/Archive/CVE-2023-4404

CVE-2023-4404

smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More — Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.1.601 × 2012.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.

Affected

ProductAffectedFixed inSource
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More≤ 1.7.0.12–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/522ecc1c-5834-4325-9234-79cf712213f3?source=cverefplugins.trac.wordpress.org/browser/charitable/tags/1.7.0.12/includes/users/class-charitable-user.php#L866