Medium severity · published Jan 19, 2023
CVE-2023-0403
The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on several AJAX actions. This makes it possible for unauthenticated attackers to delete post meta information and reset network access tokens, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Social Warfare · Warfareplugins
before 4.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0403
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0403
Exploit
https://plugins.trac.wordpress.org/browser/social-warfare/trunk/lib/options/SWP_Options_Page.php?rev=2364155#L923
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/a36d1bb1-9446-4042-a1ec-08a3ffdcb744?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/a36d1bb1-9446-4042-a1ec-08a3ffdcb744
More from Social Warfare
6.1
CVE-2019-9978
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
9.8
CVE-2021-4434
The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter
5.4
CVE-2023-4842
The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to, and including, 4.4.3…
5.4
CVE-2023-0402
The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0