CVE-2023-4293

Summary

CVE-2023-4293 is a privilege escalation vulnerability affecting the Premium Packages - Sell Digital Products Securely plugin for WordPress. In versions up to 5.7.4, the 'wpdmpp_update_profile' function lacks adequate restrictions. This issue grants authenticated attackers, including subscribers, the ability to elevate their user roles during a profile update by supplying a manipulated 'profile[role]' parameter. This vulnerability poses a significant risk, as attackers can gain unauthorized access and potentially disrupt website functionality or steal sensitive information. It is recommended that users update the plugin to the latest version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.