CVE-2023-2172

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeos_update_steps_ajax_handler, badgeos_update_award_steps_ajax_handler, badgeos_update_deduct_steps_ajax_handler, and badgeos_update_ranks_req_steps_ajax_handler functions. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to overwrite arbitrary post titles.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Aug 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-217205.3Microsoft Edge (Chromium-based) Tampering Vulnerability CVE-2023-217216.5Microsoft OneNote Elevation of Privilege Vulnerability CVE-2023-217225.0.NET Framework Denial of Service Vulnerability CVE-2023-217247.8Microsoft DWM Core Library Elevation of Privilege Vulnerability CVE-2023-217256.3Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability CVE-2023-217267.8Windows Credential Manager User Interface Elevation of Privilege Vulnerability CVE-2023-217278.8Remote Procedure Call Runtime Remote Code Execution Vulnerability CVE-2023-217287.5Windows Netlogon Denial of Service Vulnerability CVE-2023-217295.3Remote Procedure Call Runtime Information Disclosure Vulnerability CVE-2023-21734.3The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to CVE-2023-217307.8Microsoft Cryptographic Services Elevation of Privilege Vulnerability CVE-2023-217328.8Microsoft ODBC Driver Remote Code Execution Vulnerability