CVE-2023-2494 MEDIUM

CVE-2023-2494: Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting

Vendor Granth
Product Go Pricing - WordPress Responsive Pricing Tables
Weakness CWE-862 · Missing authorization
Published May 23, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to modify access to the plugin when it should only be the administrator's privilege.

Key dates

02Disclosure timeline

May 23, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-57995 WordPress DethemeKit For Elementor Plugin <= 2.1.10 - Broken Access Control Vulnerability CVE-2024-10813 Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure CVE-2024-6033 Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import CVE-2025-62882 WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability CVE-2024-5704 XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update