All Users Messenger <= 1.24 – Subscriber+ Message Deletion via IDOR | CVE 2023-4023 | Plugin Vulnerabilities

Description

The plugin does not prevent non-administrator users from deleting messages from the all-users messenger.

Proof of Concept

1) Go to the messenger
2) Catch a request that is constantly running at intervals of 3 seconds
3) Change the message time argument to true
4) Set true for permission to delete a comment. e.g. `{"userid":2,"delete":{"1690817948":true},"submit_delete":true}`

Affects Plugins

all-users-messenger

No known fix

References

CVE

URL

https://blog.cleantalk.org/cve-2023-4023-all-users-messenger/

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://blog.cleantalk.org

Verified

Yes

WPVDB ID

682c0226-28bd-4051-830d-8b679626213d

Timeline

Publicly Published

2023-08-07 (about 2 years ago)

Added

2023-08-07 (about 2 years ago)

Last Updated

2023-08-22 (about 2 years ago)

Other

Published

Title

Published

2024-03-29

Title

Whizzy <= 1.1.18 - Authenticated (Subscriber+) Insecure Direct Object Reference

Published

2025-06-23

Title

MDJM Event Management <= 1.7.6.3 - Subscriber+ Privilege Escalation

Published

2022-08-01

Title

WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR

Published

2024-12-03

Title

LA-Studio Element Kit for Elementor < 1.4.5 - Authenticated (Contributor+) Post Disclosure

Published

2023-08-01

Title

Stripe Payment Plugin for WooCommerce < 3.7.8 - Authentication Bypass