CVE-2023-2173

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeos_delete_step_ajax_handler, badgeos_delete_award_step_ajax_handler, badgeos_delete_deduct_step_ajax_handler, and badgeos_delete_rank_req_step_ajax_handler functions. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-217307.8Microsoft Cryptographic Services Elevation of Privilege VulnerabilityCVE-2023-217328.8Microsoft ODBC Driver Remote Code Execution VulnerabilityCVE-2023-217337.0Windows Bind Filter Driver Elevation of Privilege VulnerabilityCVE-2023-217347.8Microsoft Office Remote Code Execution VulnerabilityCVE-2023-217357.8Microsoft Office Remote Code Execution VulnerabilityCVE-2023-217367.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2023-217377.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2023-217387.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2023-217397.0Windows Bluetooth Driver Elevation of Privilege VulnerabilityCVE-2023-21744.3The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_CVE-2023-217407.8Windows Media Remote Code Execution VulnerabilityCVE-2023-217417.1Microsoft Office Visio Information Disclosure Vulnerability
CVE-2023-2173: Medium severity, CVSS 4.3 | Vulnix