CVE-2023-5235

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Ovic Responsive WPBakery WordPress plugin before 1.2.9 does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'users_can_register' and 'default_role'. It also unserializes user input in the process, which may lead to Object Injection attacks.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-523504.4In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with Syste CVE-2023-523517.8In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with Syste CVE-2023-523525.5In Network Adapter Service, there is a possible missing permission check. This could lead to local denial of service with no additional exec CVE-2023-523537.5An issue was discovered in Mbed TLS through 3.5.1. In mbedtls_ssl_session_reset, the maximum negotiable TLS version is mishandled. For examp CVE-2023-523547.5chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.CVE-2023-523557.5An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. Thi CVE-2023-523567.5A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. Th CVE-2023-523577.5Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect CVE-2023-523586.2Vulnerability of configuration defects in some APIs of the audio module.Successful exploitation of this vulnerability may affect availabilit CVE-2023-523597.5Vulnerability of permission verification in some APIs in the ActivityTaskManagerService module. Impact: Successful exploitation of this vuln CVE-2023-52366.5A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficie CVE-2023-523607.5Logic vulnerabilities in the baseband.Successful exploitation of this vulnerability may affect service integrity.