CVE-2023-7198
Medium
Description
The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses a significant security risk as it violates the principle of least privilege and compromises the integrity and privacy of user data.
SeverityMedium
CVSS4.3
Exploit probability—
ProductJeroensormani Wp Dashboard Notes
PublishedFeb 27, 2024
First seenFeb 27, 2024
How to fix
Update
- jeroensormani wp_dashboard_notes1.0.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jeroensormani wp_dashboard_notes | v < 1.0.11 | 1.0.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.