WordPress Plugin Vulnerabilities

Multiple Plugins from ServMask - Unauthenticated Access Token Update

Description

The plugins do not have authorisation in the init() function hooked to the admin_init action, allowing unauthenticated attackers to update the access token

Proof of Concept

Affects Plugins

Plugin icon
all-in-one-wp-migration-box-extension
Fixed in 1.54
Plugin icon
all-in-one-wp-migration-dropbox-extension
Fixed in 3.76
Plugin icon
all-in-one-wp-migration-gdrive-extension
Fixed in 2.80
Plugin icon
all-in-one-wp-migration-onedrive-extension
Fixed in 1.67

References

CVE
CVE-2023-40004

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
Yes
WPVDB ID
637bbd1d-2bf2-470e-8d19-bd48a2280530

Timeline

Publicly Published
2023-08-30 (about 2 years ago)
Added
2023-08-31 (about 2 years ago)
Last Updated
2023-08-31 (about 2 years ago)

Other

Published
Title
Published
2024-06-06
Title
Dashboard To-Do List < 1.3.0 - Missing Authorization via ardtdw_widgetsetup()
Published
2026-01-23
Title
Alchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion
Published
2026-02-13
Title
Accordion and Accordion Slider < 1.4.6 - Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification
Published
2024-01-30
Title
WOLF – WordPress Posts Bulk Editor and Manager Professional < 1.0.8.2 - Missing Authorization
Published
2025-12-16
Title
Converter for Media < 6.4.0 - Subscriber+ Optimized Image Deletion via regenerate-attachment REST Endpoint