CVE-2023-22701 HIGH

CVE-2023-22701: WordPress Ebook Store plugin <= 5.775 - Broken Authentication vulnerability

Vendor Shopfiles Ltd
Product Ebook Store
Weakness CWE-862 · Missing authorization
Published December 9, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in Shopfiles Ltd Ebook Store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ebook Store: from n/a through 5.775.

Explanation of Vulnerability in Simple Terms

02Summary

Ebook Store versions up to 5.775 lack proper authorization checks, allowing unauthenticated attackers to read sensitive data without logging in. The vulnerability affects the application's access control mechanism, exposing confidential information to anyone with network access. No user interaction is required to exploit this flaw. Update to a version newer than 5.775 to remediate.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the application without authentication.

Potential impact on your site

04Site Impact

Confidential data stored in Ebook Store is exposed to unauthorized access by anyone on the internet.

Conditions required to exploit

05Prerequisites

Network access to the application; no authentication or user interaction required.

Key dates

06Disclosure timeline

December 9, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-11912 Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action CVE-2026-12349 Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions CVE-2026-40722 WordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerability CVE-2026-13468 Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint CVE-2026-40809 WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability