CVE-2023-6968highCWE-284

CVE-2023-6968: fallo de gravedad alta en lvaudore The Moneytizer

The Moneytizer <= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actions

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear The Moneytizer

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 0.2%
The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due to missing or incorrect nonce validation on multiple AJAX functions. This makes it possible for unauthenticated attackers to to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
lvaudore · The Moneytizer
CVEs relacionadas — lvaudore The Moneytizer

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-6966HIGHThe Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actionsEPSS 0.4%CVE-2026-39685MEDIUMWordPress The Moneytizer plugin <= 10.0.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-62756MEDIUMWordPress The Moneytizer plugin <= 10.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%