CVE-2023-32590
Published: 20 December 2023
Summary
CVE-2023-32590 is a critical-severity SQL Injection (CWE-89) vulnerability in Subscribe To Category Project Subscribe To Category. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2023-32590 is an SQL injection issue (CWE-89) caused by improper neutralization of special elements in SQL commands. It affects the Subscribe to Category WordPress plugin in all versions through 2.7.4.
Unauthenticated remote attackers can exploit the flaw over the network without credentials or user interaction. Successful exploitation grants high-impact read access to the database along with limited availability effects, as reflected in the CVSS 9.3 score that notes changed scope.
Patchstack advisories list the affected plugin versions and point administrators to the vendor for remediation steps, primarily through plugin updates that close the injection vector. The associated EPSS score of 0.1932 has remained flat at its peak value, indicating sustained but not newly emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-36833
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category.This issue affects Subscribe to Category: from n/a through 2.7.4.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.