CVE-2023-27428

The WP users media plugin for WordPress, versions from n/a through 4.2.3, contains a missing authorization vulnerability. The plugin fails to properly verify access control security levels, allowing incorrect configuration of access controls [1].

This broken access control issue means that functions lack necessary authorization, authentication, or nonce token checks. As a result, unprivileged users can execute actions that should require higher privileges [1]. Such vulnerabilities are known to be used in mass-exploit campaigns targeting thousands of websites regardless of size or popularity [1].

An attacker exploiting this vulnerability gains the ability to perform unauthorized actions within the WordPress environment. The specific impact depends on which higher-privileged functions become accessible, but the vulnerability allows attackers to bypass intended access restrictions [1].

As of the advisory publication date, users are strongly advised to update the plugin to a patched version if available. If an immediate update is not possible, contacting the hosting provider or a web developer is recommended as a temporary measure [1].