CVE-2023-2078

Summary

CVE-2023-2078 is a vulnerability affecting the "Buy Me a Coffee – Button and Widget Plugin" for WordPress. This issue allows authenticated attackers, even with minimal permissions like subscribers, to modify plugin settings without proper capability checks on functions such as receive_post, bmc_disconnect, name_post, and widget_post. Versions up to and including 3.7 are susceptible to this unauthorized data manipulation. No confirmation has been made if CVE-2023-25030 is a duplicate of this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.