WordPress Plugin Vulnerabilities

Nested Pages < 3.2.4 - Editor+ Plugin Settings Reset

Description

The plugin does not properly authorize the npresetSettings ajax action, allowing users with an editor role or above to reset the plugin settings.

Affects Plugins

Plugin icon
wp-nested-pages
Fixed in 3.2.4

References

CVE
CVE-2023-2434
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-nested-pages/nested-pages-323-missing-authorization-to-authenticated-editor-plugin-settings-reset

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
89796e6d-80e9-42f6-958d-24e1745b7510

Timeline

Publicly Published
2023-05-30 (about 2 years ago)
Added
2023-05-31 (about 2 years ago)
Last Updated
2023-05-31 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Blaze Slideshow 2.1 - Unspecified Security
Published
2025-12-05
Title
SV100 Companion <= 2.0.02 - Unauthenticated Privilege Escalation
Published
2016-06-21
Title
WordPress 3.6-4.5.2 - Authenticated Revision History Information Disclosure
Published
2025-08-15
Title
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.1 - Directory Traversal
Published
2014-08-01
Title
Site5 Wordpress Themes Email Spoofing