CVE-2023-6077
Medium
Description
The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected
SeverityMedium
CVSS6.5
Exploit probability—
ProductWpfrank Slider Factory Pro
PublishedDec 18, 2023
First seenDec 18, 2023
Weakness typeCWE-862Missing authorization
How to fix
Update
- wpfrank slider_factory_pro3.5.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpfrank slider_factory_pro | v < 3.5.12 | 3.5.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.