What is CVE-2023-1371?

CVE-2023-1371 is a medium-severity vulnerability in W4 Post List Project, classified under Missing Authorization. CVSS score: 6.5/10. Published 2023-04-17.

How severe is CVE-2023-1371?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2023-1371 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in W4 Post List Project

CVE-2023-1371

The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them

Vulnerability class: Broken Access Control

EPSS: 0.007 (47.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

W4_post_list_project W4_post_list
Unknown W4 Post List — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

20142995/nuclei-templates

References

contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)

Frequently asked questions

What is CVE-2023-1371?: CVE-2023-1371 is a medium-severity vulnerability in W4 Post List Project, classified under Missing Authorization. CVSS score: 6.5/10. Published 2023-04-17.
How severe is CVE-2023-1371?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2023-1371 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.