CVE-2023-2562

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to obtain a list of images attached to a post.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
billerickson	Gallery Metabox	<= 1.5

References

Timeline

Published: Jul 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-256206.5A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller wh CVE-2023-256216.5Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the CVE-2023-25634.3The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.CVE-2023-256325.5The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.CVE-2023-256410.0OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.CVE-2023-256426.5There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Due to insufficient validation of tcp port parameter, an aut CVE-2023-256438.8There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network pa CVE-2023-256447.5There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, CVE-2023-256457.7There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged appli CVE-2023-256466.4There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common use CVE-2023-256473.3There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile pho CVE-2023-256487.8There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user