« Volver al listado

CVE-2023-2334

Estado: AnalizadaMedia (5.4)—

The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Gsheetconnector — EDD GsheetconnectorWesterndeal — Easy Digital Downloads Google Sheet Connector

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-2334",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-2334",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-16T18:34:36.311876Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "edd-google-sheet-connector-pro",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.4",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Unknown",
          "product": "Easy Digital Downloads Google Sheet Connector",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.6.6",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-15T20:15:24.957",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/95562684-2bb1-46f0-838c-8501db6b43ed/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack"
    },
    {
      "lang": "es",
      "value": "El complemento edd-google-sheet-connector-pro de WordPress anterior a la versión 1.4 y el complemento de WordPress Easy Digital Downloads Google Sheet Connector anterior a la versión 1.6.6 no tienen comprobación CSRF al actualizar su código de acceso, lo que podría permitir a los atacantes hacer que el administrador que haya iniciado sesión cambie el código de acceso a uno arbitrario mediante un ataque CSRF."
    }
  ],
  "lastModified": "2026-06-17T05:52:18.560",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:westerndeal:easy_digital_downloads_google_sheet_connector:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5FC6C1B-C9D2-4DF2-BD8D-A117F4FDC12E",
              "versionEndExcluding": "1.6.6"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gsheetconnector:edd_gsheetconnector:*:*:*:*:pro:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B684A6A7-D362-44ED-84BF-1144C7A07F02",
              "versionEndExcluding": "1.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}