Medium severity · published Aug 16, 2023
CVE-2023-3958
WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WR
WP Remote Users Sync · frogerme
through 1.2.12 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3958
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3958
Product
https://plugins.trac.wordpress.org/browser/wp-remote-users-sync/trunk/inc/api/class-wprus-api-abstract.php#L674
Patch
https://plugins.trac.wordpress.org/changeset/2946667/wp-remote-users-sync#file127
Patch
https://plugins.trac.wordpress.org/changeset/2953845/wp-remote-users-sync#file0
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/2e78c759-4a54-4ee4-8eff-df91fe9dad46?source=cve
More from WP Remote Users Sync
4.3
CVE-2023-4374
WP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log View