CVE-2023-47224
Published: 02 January 2025
Summary
CVE-2023-47224 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-47224 is a missing authorization vulnerability (CWE-862) in the WP Travel WordPress plugin (wp-travel). It enables exploiting incorrectly configured access control security levels and affects all versions of the plugin from n/a through 7.8.0. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating high severity due to its network accessibility and integrity impact.
Unauthenticated attackers (PR:N) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Exploitation allows high integrity impact (I:H), potentially enabling unauthorized modifications to data or resources protected by the plugin's access controls.
Patchstack provides details on this broken access control vulnerability in the WP Travel plugin via its advisory at https://patchstack.com/database/Wordpress/Plugin/wp-travel/vulnerability/wordpress-wp-travel-plugin-7-5-0-broken-access-control-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance and patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-51356
Vulnerability details
Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a through <= 7.8.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (broken access control) in a publicly accessible WordPress plugin directly enables remote exploitation of a public-facing web application without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the missing authorization flaw in the WP Travel plugin by identifying, reporting, and applying patches for the specific CVE.
Enforces approved authorizations for access to system resources, directly addressing the plugin's missing authorization checks that allow unauthenticated modifications.
Limits unauthorized access impact by applying least privilege principles, reducing the scope of modifications possible even if authorization is bypassed in the plugin.