Cyber Resilience

CVE-2023-45104

High

Published: 02 January 2025

Published
02 January 2025
Modified
29 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0028 51.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-45104 is a high-severity Missing Authorization (CWE-862) vulnerability in Wpdeveloper Betterlinks. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2023-45104 is a missing authorization vulnerability (CWE-862) in the WPDeveloper BetterLinks plugin for WordPress, stemming from incorrectly configured access control security levels. The issue affects all versions of BetterLinks up to and including 1.6.0. It has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites for exploitation.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts across confidentiality, integrity, and availability, such as partial unauthorized access to data, minor modifications, or denial-of-service effects within the plugin's scope.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/betterlinks/vulnerability/wordpress-betterlinks-plugin-1-6-0-broken-access-control-vulnerability?_s_id=cve details the broken access control issue in BetterLinks versions up to 1.6.0, recommending updates to patched versions for mitigation.

EU & UK References

Vulnerability details

Missing Authorization vulnerability in WPDeveloper BetterLinks betterlinks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterLinks: from n/a through <= 1.6.0.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Missing authorization (broken access control) in a publicly accessible WordPress plugin directly enables remote unauthenticated exploitation of a public-facing web application.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-26871Same vendor: Wpdeveloper
CVE-2026-45209Shared CWE-862
CVE-2026-25026Shared CWE-862
CVE-2026-42083Shared CWE-862
CVE-2026-0656Shared CWE-862
CVE-2026-24532Shared CWE-862
CVE-2025-13603Shared CWE-862
CVE-2023-46632Shared CWE-862
CVE-2025-69063Shared CWE-862
CVE-2026-3045Shared CWE-862

Affected Assets

wpdeveloper
betterlinks
≤ 1.6.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

AC-3 mandates enforcement of approved authorizations for access to system resources, directly countering the missing authorization vulnerability in BetterLinks.

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely identification, reporting, and correction of system flaws, enabling patching of the specific broken access control issue in BetterLinks versions <=1.6.0.

AC-6 Least Privilege partial match
prevent

AC-6 enforces least privilege, limiting the scope and impact of unauthorized actions enabled by the plugin's access control failure.

References