CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 6.5. It affects WordPress. Exploitation may require the attacker to be authenticated.
CVE
CVE-2023-5386
Severity
MEDIUM
CVSS
6.5
EPSS
0.41%
WordPress
Original NVD Description
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts, including administrator posts, and posts not related to the Funnelforms Free plugin. CVE-2023-5990 appears to be a duplicate of this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)