CVE-2023-4668

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins (present and active), active theme, various plugin settings, WordPress version, as well as some server settings such as memory limit, installation paths.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-466817.8Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. 2.37 and earlier CVE-2023-466837.2A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigab CVE-2023-466859.8A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of spec CVE-2023-466867.1A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallagher Command Centre Diag CVE-2023-466879.8In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands i CVE-2023-466886.1Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web s CVE-2023-466897.8Improper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escal CVE-2023-46699.8Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYS CVE-2023-466908.8In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location o CVE-2023-466917.8Use after free in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation o CVE-2023-466936.1Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters.CVE-2023-466948.1Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands. This flaw ex