CVE-2023-4703

Published: Jan 16, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation.

Affected (1)

Products: All In One B2b For Woocommerce Project: All In One B2b For Woocommerce

All In One B2b For Woocommerce Project

1 product

All In One B2b For Woocommerce

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
All In One B2b For Woocommerce Project All In One B2b For Woocommerce	version ≤ 1.0.3

References (2)

https://wpscan.com/vulnerability/83278bbb-90e6-4465-a46d-60b4c703c11a/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/83278bbb-90e6-4465-a46d-60b4c703c11a/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.