CVE-2023-1597
High
Description
The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.
SeverityHigh
CVSS8.8
Exploit probability—
ProductTagdiv Cloud Library
PublishedJul 10, 2023
First seenJul 10, 2023
How to fix
Update
- tagdiv cloud_library2.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tagdiv cloud_library | v < 2.7 | 2.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.