CVE-2023-44151
📋 TL;DR
This CVE describes a Missing Authorization vulnerability in the WordPress Pre-Publish Checklist plugin by Brainstorm Force. It allows unauthorized users to access functionality intended only for authorized users, affecting all WordPress sites using vulnerable versions of this plugin.
💻 Affected Systems
- WordPress Pre-Publish Checklist plugin by Brainstorm Force
📦 What is this software?
Pre Publish Checklist by Brainstormforce
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could modify or delete pre-publish checklist settings, potentially disrupting editorial workflows or causing content publication issues.
Likely Case
Low-privileged users could access or modify checklist settings they shouldn't have permission to view or change.
If Mitigated
With proper user role management and access controls, impact would be limited to authorized users only.
🎯 Exploit Status
Exploitation requires some level of WordPress user access, though potentially lower privileges than intended.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.1.1
Vendor Advisory: https://patchstack.com/database/vulnerability/pre-publish-checklist/wordpress-pre-publish-checklist-plugin-1-1-1-broken-access-control-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Pre-Publish Checklist' and click 'Update Now'. 4. Alternatively, download latest version from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Pre-Publish Checklist plugin until patched
wp plugin deactivate pre-publish-checklist
Restrict user roles
allLimit WordPress user accounts and review role permissions
🧯 If You Can't Patch
- Remove the Pre-Publish Checklist plugin entirely
- Implement network-level restrictions to WordPress admin interface
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Pre-Publish Checklist > Version. If version is 1.1.1 or earlier, you are vulnerable.Check Version:
wp plugin get pre-publish-checklist --field=versionVerify Fix Applied:
After updating, verify plugin version is higher than 1.1.1 in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual access to pre-publish checklist admin pages by unauthorized users
- Changes to checklist settings from unexpected user accounts
Network Indicators:
- HTTP requests to /wp-admin/admin.php?page=pre-publish-checklist from unauthorized IPs
SIEM Query:
source="wordpress.log" AND ("pre-publish-checklist" OR "admin.php?page=pre-publish-checklist") AND user_role!="administrator"🔗 References
- https://patchstack.com/database/vulnerability/pre-publish-checklist/wordpress-pre-publish-checklist-plugin-1-1-1-broken-access-control-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/pre-publish-checklist/wordpress-pre-publish-checklist-plugin-1-1-1-broken-access-control-vulnerability?_s_id=cve
