WordPress security changelog
MEDIUM CVE-2023-1979 Modified

Web Stories for: A security weakness

Web Stories for is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

CVE / CNA score 4.9 CVSS 3.1 · cve-coordination@google.com
NVD score 6.5 CVSS 3.1 · nvd@nist.gov
Component
Web Stories for
Plugin slug
web-stories
Affected
See vendor advisory
Safe version
See mitigation notes
Published
May 08, 2023
Weakness
CWE-863 — Incorrect Authorization

This CVE was published May 08, 2023 and is one of 3 known issues for this plugin.

Update, patch or deactivate.

Update Web Stories for to a release outside the affected range, or disable and remove it until a fixed version is available.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Technical description

The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

NVD vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary and upstream sources