CVE-2023-51700
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2023-51700 is a vulnerability affecting the WP-Mobile-BankID-Integration plugin for WordPress prior to version 1.0.1. This vulnerability, classified as a Deserialization of Untrusted Data vulnerability, can be exploited by unauthorized actors who gain access to the database. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. To remediate this vulnerability, users of the plugin should upgrade to version 1.0.1 or later, where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. Alternatively, stricter access controls on the database can be enforced to limit modifications by only trusted and authorized entities. The potential danger posed by this vulnerability is high, as it has a base severity rating of CRITICAL and impact scores of HIGH for integrity and confidentiality.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions