CVE-2023-4924

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_bulkoperations_delete function. This makes it possible for authenticated attackers, with subscriber access or higher, to delete products.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-492407.5Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-492417.5API permission control vulnerability in the network management module. Successful exploitation of this vulnerability may affect service conf CVE-2023-492427.5Free broadcast vulnerability in the running management module. Successful exploitation of this vulnerability may affect service confidential CVE-2023-492437.5Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect serv CVE-2023-492447.5Permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect service confidentiali CVE-2023-492457.5Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect service confidentiali CVE-2023-492467.5Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidenti CVE-2023-492477.5Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentia CVE-2023-492485.5Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file acc CVE-2023-49254.8The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privi CVE-2023-492507.3Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https CVE-2023-492518.8A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected a