CVE-2023-6985

2024-02-0521:21:36

Wordfence

raw.githubusercontent.com

10web ai assistant

wordpress

unauthorized modification

data

capability check

install_plugin ajax action

authenticated attackers

subscriber level

6.4 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

18.4%

JSON

The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.