CVE-2023-46632
Published: 02 January 2025
Summary
CVE-2023-46632 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-46632 is a missing authorization vulnerability (CWE-862) in the My Shortcodes WordPress plugin by David Cramer. The flaw allows exploiting incorrectly configured access control security levels and affects all versions of the plugin from n/a through 2.3. It carries a CVSS v3.1 base score of 7.1, rated as high severity with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H.
The vulnerability can be exploited by a low-privileged authenticated user (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables limited integrity modifications (I:L) and high-impact disruption to availability (A:H), such as denial of service, while confidentiality remains unaffected (C:N) and scope is unchanged (S:U).
The Patchstack advisory provides further details on this broken access control issue in My Shortcodes version 2.3 and related mitigation guidance at https://patchstack.com/database/wordpress/plugin/my-shortcodes/vulnerability/wordpress-my-shortcodes-plugin-2-3-broken-access-control-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-50834
Vulnerability details
Missing Authorization vulnerability in David Cramer My Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Shortcodes: from n/a through 2.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization in public-facing WordPress plugin directly enables remote exploitation of the web application by authenticated users.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the missing authorization vulnerability by requiring the system to enforce approved authorizations, preventing low-privileged users from exploiting access control flaws.
Mitigates the specific code flaw in the My Shortcodes plugin by identifying, reporting, and correcting vulnerabilities like missing authorization checks.
Limits the impact of broken access control by ensuring low-privileged users only have minimal privileges necessary for their roles, reducing potential for high availability disruption.