What is CVE-2023-40004?

CVE-2023-40004 is a high-severity vulnerability in Servmask All-In-One Wp Migration Box Extension, classified under Missing Authorization. CVSS score: 7.3/10. Published 2024-06-19.

How severe is CVE-2023-40004?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2023-40004 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Servmask All-In-One Wp Migration Box Extension

CVE-2023-40004

Missing Authorization vulnerability in ServMask All-in-One WP Migration Box Extension, ServMask All-in-One WP Migration OneDrive Extension, ServMask All-in-One WP Migration Dropbox Extension, ServMask All-in-One WP Migration Google Drive Extension.This issue affects All-in-One WP Migration Box Extension: from n/a through 1.53; All-in-One WP Migration OneDrive Extension: from n/a through 1.66; All-in-One WP Migration Dropbox Extension: from n/a through 3.75; All-in-One WP Migration Google Drive Extension: from n/a through 2.79.

Vulnerability class: Broken Access Control

Published 2024-06-19 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.110 (95.8th percentile), scored 2026-09-28.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.097 · newest: 0.110 · change: +0.012

Affected products

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

20142995/nuclei-templates

References

patchstack.com/database/vulnerability/all-in-one-wp-migration-gdrive-extension/… (vdb-entry)
patchstack.com/database/vulnerability/all-in-one-wp-migration-dropbox-extension… (vdb-entry)
patchstack.com/database/vulnerability/all-in-one-wp-migration-onedrive-extensio… (vdb-entry)
patchstack.com/database/vulnerability/all-in-one-wp-migration-box-extension/wor… (vdb-entry)
patchstack.com/articles/pre-auth-access-token-manipulation-in-all-in-one-wp-mig… (technical-description, third-party-advisory)

Frequently asked questions

What is CVE-2023-40004?: CVE-2023-40004 is a high-severity vulnerability in Servmask All-In-One Wp Migration Box Extension, classified under Missing Authorization. CVSS score: 7.3/10. Published 2024-06-19.
How severe is CVE-2023-40004?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2023-40004 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.