Medium severity · published Nov 20, 2023
CVE-2023-5509
myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FN
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme ·
before 2.6.5 · source: vendor
MY
Mystickymenu · Premio
before 2.6.5 · source: NVD
Affected product
FN
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-5509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-5509
Exploit
https://wpscan.com/vulnerability/3b33c262-e7f0-4310-b26d-4727d7c25c9d
More from Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme
4.8
CVE-2024-2643
My Sticky Bar < 2.6.8 - Admin+ Stored XSS
4.8
CVE-2024-7133
My Sticky Bar < 2.7.3 - Admin+ Stored XSS
4.8
CVE-2024-4090
My Sticky Bar < 2.7.2 - Admin+ Stored XSS