CVE-2023-29239

Vulnerability

The LuckyWP Scripts Control plugin for WordPress versions 1.2.1 and earlier suffers from a Missing Authorization vulnerability. This flaw stems from incorrectly configured access control security levels, allowing unauthenticated or low-privileged users to bypass intended permission checks [1].

Exploitation

To exploit this vulnerability, an attacker does not need elevated privileges; they can leverage the missing authorization to execute actions that should require higher-level permissions. The attack surface includes any functionality lacking proper nonce or capability checks, potentially leading to unauthorized modifications of scripts or settings [1].

Impact

Successful exploitation grants an attacker the ability to tamper with site configurations, inject malicious scripts, or perform other actions that undermine the security of the WordPress installation. This could lead to further compromise, especially if combined with other vectors [1].

Mitigation

The vulnerability has been patched in version 1.2.2. Users are strongly advised to update the plugin immediately. Patchstack has also issued a mitigation rule to block attacks until updates are applied [1].