CVE-2023-33327 HIGH

CVE-2023-33327: WordPress Leyka plugin <= 3.30.2 - Privilege Escalation vulnerability

Vendor Teplitsa Of Social Technologies
Product Leyka
Weakness CWE-269
Published May 14, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.30.2.

Explanation of Vulnerability in Simple Terms

02Summary

Leyka versions up to 3.30.2 contain a privilege management flaw that allows authenticated users with low-level access to gain unauthorized elevated privileges. An attacker with a basic user account can read, modify, or delete sensitive data and disrupt site operations. The vulnerability requires network access and a valid login but no additional user interaction. Update to version 3.32.2 or later.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete sensitive data; disrupt site availability with a low-privilege user account.

Potential impact on your site

04Site Impact

Compromised user accounts can escalate to admin-level access, risking data theft, site defacement, and downtime.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege user account and network access to the site.

Key dates

06Disclosure timeline

May 14, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-13741 Digits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter CVE-2026-4880 Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication CVE-2025-12882 Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation CVE-2025-12981 Listee <= 1.1.6 - Unauthenticated Privilege Escalation CVE-2026-6898 WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action