CVE-2023-6389
Published: 29 January 2024
Summary
CVE-2023-6389 is a medium-severity Open Redirect (CWE-601) vulnerability in Abhinavsingh Wordpress Toolbar. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The WordPress Toolbar plugin for WordPress through version 2.2.6 contains an open redirect vulnerability (CWE-601) that allows arbitrary URL redirection through the "wptbto" parameter. The flaw affects any site using the plugin and carries a CVSS 3.1 score of 6.1, reflecting network attack vector, low complexity, no required privileges, and required user interaction with changed scope.
Unauthenticated attackers can exploit the issue by crafting a malicious link containing the vulnerable parameter; if a victim is successfully tricked into clicking it, the attacker can redirect the user to an arbitrary destination under attacker control, enabling phishing or further social-engineering attacks.
Public references published alongside the disclosure, including detailed reports on WPScan and Magos Securitas, document the parameter manipulation but do not describe vendor patches or configuration workarounds. The associated EPSS score has remained flat at its peak value of 0.5873 with no indicated rise after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58629
Vulnerability details
The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.