Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

7,381 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-30479

    WordPress Stamped.io Product Reviews & UGC for WooCommerce plugin <= 2.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce: from n/a through 2.…

    Stamped.io Stamped.io Product Reviews & UGC for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-30476

    WordPress Blogger Buzz theme <= 1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.

    Sparkle Themes Blogger Buzz
  • Medium 4.3
    CVE-2023-30486 Public exploit

    WordPress Square theme <= 2.0.0 - Broken Access Control

    Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.

    HashThemes Square
  • Medium 5.3
    CVE-2023-30488

    WordPress Featured Post Creative plugin <= 1.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through 1.2.7.

    WP OnlineSupport, Essential Plugin Featured Post Creative
  • Medium 4.3
    CVE-2023-30783

    WordPress Smart WooCommerce Search plugin <= 2.5.0 - Broken Access Control

    Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0.

    YummyWP Smart WooCommerce Search Web / CMS
  • Medium 6.5
    CVE-2023-30870

    WordPress Sharkdropship for AliExpress Dropship and Affiliate plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilities

    Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship and Affiliate: from …

    Woo product importer Sharkdropship for AliExpress Dropship and Affiliate
  • Medium 5.4
    CVE-2023-30873

    WordPress WP Docs plugin <= 1.9.8 - Broken Access Control

    Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1.9.8.

    Fahad Mahmood WP Docs
  • Medium 4.3
    CVE-2023-31073

    WordPress Shortcode to display post and user data plugin <= 1.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and U…

    Jose Vega Display custom fields in the frontend – Post and User Profile Fields
  • Medium 5.4
    CVE-2023-31214

    WordPress WP Quick Post Duplicator plugin <= 2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through 2.0.

    Arul Prasad J WP Quick Post Duplicator
  • Medium 5.4
    CVE-2023-32094

    WordPress Extended Post Status plugin <= 1.0.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Felix Welberg Extended Post Status allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extended Post Status: from n/a through 1.0.19.

    Felix Welberg Extended Post Status
  • Medium 5.3
    CVE-2023-32293

    WordPress WRC Pricing Tables plugin <= 2.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Realwebcare WRC Pricing Tables allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WRC Pricing Tables: from n/a through 2.3.7.

    Realwebcare WRC Pricing Tables
  • Medium 4.3
    CVE-2023-32126

    WordPress SALERT plugin <= 1.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPoperation SALERT allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALERT: from n/a through 1.2.1.

    WPoperation SALERT
  • Medium 6.5
    CVE-2023-32299

    WordPress Ni WooCommerce Sales Report plugin <= 3.7.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Sales Report ni-woocommerce-sales-report allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Sales Report: from n/a through <= 3.7.3.

    Anzar Ahmed Ni WooCommerce Sales Report Web / CMS
  • Medium 5.4
    CVE-2023-47694

    WordPress Mini Cart Drawer For WooCommerce plugin <= 4.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in appsbd Mini Cart Drawer For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mini Cart Drawer For WooCommerce: from n/a through 4.0.0.

    Appsbd Mini Cart Drawer For WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-47756

    WordPress Welcome Email Editor plugin <= 5.0.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in David Vongries Welcome Email Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcome Email Editor: from n/a through 5.0.6.

    David Vongries Welcome Email Editor
  • Medium 4.3
    CVE-2023-47760

    WordPress Essential Blocks plugin <= 4.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

    WPDeveloper Essential Blocks for Gutenberg
  • Medium 4.3
    CVE-2023-47761

    WordPress Simple 301 Redirects by BetterLinks plugin <= 2.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks simple-301-redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple 301 Redirects by BetterLinks: from n/a through <= 2.0…

    WPDeveloper Simple 301 Redirects by BetterLinks
  • Medium 4.3
    CVE-2023-47762

    WordPress BetterDocs plugin <= 2.5.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper BetterDocs betterdocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterDocs: from n/a through <= 2.5.2.

    WPDeveloper BetterDocs
  • Medium 4.3
    CVE-2023-47763

    WordPress WP Custom Admin Interface plugin <= 7.31 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.31.

    Northern Beaches Websites WP Custom Admin Interface
  • Medium 6.5
    CVE-2023-47764

    WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerability

    Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= 3.1.24.

    Metaphor Creations Ditty
  • Medium 4.3
    CVE-2023-47776

    WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through <= 4.2.1.

    miniOrange miniorange otp verification
  • Medium 4.3
    CVE-2023-47780

    WordPress EasyAzon – Amazon Associates Affiliate Plugin plugin <= 5.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in flowdee EasyAzon easyazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyAzon: from n/a through <= 5.1.0.

    flowdee EasyAzon
  • Medium 4.3
    CVE-2023-47793

    WordPress Acme Fix Images plugin <= 1.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Acme Themes Acme Fix Images acme-fix-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through <= 1.0.0.

    Acme Themes Acme Fix Images
  • Medium 5.3
    CVE-2023-47805

    WordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 2.2.22.

    Arraytics WPCafe
  • Medium 4.3
    CVE-2023-47820

    WordPress WP Like Button plugin <= 1.7.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CRUDLab WP Like Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Like Button: from n/a through 1.7.0.

    CRUDLab WP Like Button
  • Medium 5.4
    CVE-2023-47822

    WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 4.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/…

    SONAAR MUSIC MP3 Audio Player for Music, Radio & Podcast by Sonaar
  • Medium 5.3
    CVE-2023-47823

    WordPress FormCraft – Contact Form Builder for WordPress plugin <= 1.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.7.

    nCrafts FormCraft Web / CMS
  • Medium 6.5
    CVE-2023-47826

    WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NicheAddons Restaurant & Cafe Addon for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restaurant & Cafe Addon for Elementor: from n/a through 1.5.3.

    nicheaddons Restaurant & Cafe Addon for Elementor
  • Medium 5.4
    CVE-2023-47830

    WordPress Live Preview for Contact Form 7 plugin <= 1.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Addons for Contact Form 7 Live Preview for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Preview for Contact Form 7: from n/a through 1.2.0.

    Addons for Contact Form 7 Live Preview for Contact Form 7
  • Medium 5.3
    CVE-2023-47832

    WordPress SearchIQ plugin <= 4.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SearchIQ SearchIQ searchiq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SearchIQ: from n/a through <= 4.4.

    SearchIQ SearchIQ
  • Medium 5.4
    CVE-2023-47836

    WordPress WP Meta and Date Remover plugin <= 2.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in prasadkirpekar WP Meta and Date Remover wp-meta-and-date-remover allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meta and Date Remover: from n/a through <= 2.3.0.

    Prasad Kirpekar WP Meta and Date Remover
  • Medium 4.3
    CVE-2023-47838

    WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conditional Fields for Contact Form 7: from n/a through …

    Jules Colle Conditional Fields for Contact Form 7
  • Medium 4.3
    CVE-2023-47841

    WordPress Analytify plugin <= 5.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Analytify Analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through 5.1.1.

    Analytify Analytify
  • Medium 5.3
    CVE-2023-47847

    WordPress PayTR Taksit Tablosu plugin <= 1.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayTR Taksit Tablosu: from n/a through 1.3.1.

    PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit Tablosu
  • Medium 4.3
    CVE-2023-47849

    WordPress BlossomThemes Email Newsletter plugin <= 2.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Blossom Themes BlossomThemes Email Newsletter blossomthemes-email-newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through <= …

    Blossom Themes BlossomThemes Email Newsletter
  • Medium 4.3
    CVE-2023-47871

    WordPress Contact Form to Any API plugin <= 1.1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in IT Path Solutions Contact Form to Any API allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form to Any API: from n/a through 1.1.6.

    IT Path Solutions Contact Form to Any API
  • Medium 6.5
    CVE-2023-48274

    WordPress WCMultiShipping plugin <= 2.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCMultiShipping: from n/a through 2.3.5.

    Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping
  • Medium 5.4
    CVE-2023-48324

    WordPress Awesome Support HelpDesk plugin <= 6.1.4 - Broken Access control vulnerability

    Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.1.4.

    Awesome Support Awesome Support
  • Medium 5.4
    CVE-2023-48287

    WordPress TextMe SMS plugin <= 1.9.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Matat Technologies TextMe SMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through 1.9.0.

    Matat Technologies TextMe SMS
  • Medium 4.3
    CVE-2023-48332

    WordPress Mail Bank – #1 Mail SMTP Plugin for WordPress plugin <= 4.0.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Varun Sharma Mail Bank - #1 Mail SMTP Plugin for WordPress wp-mail-bank allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mail Bank - #1 Mail SMTP Plugin for WordPress: from n/a t…

    Varun Sharma Mail Bank - #1 Mail SMTP Plugin for WordPress Web / CMS