CVE-2023-34186 MEDIUM

CVE-2023-34186: WordPress Headless CMS plugin <= 2.0.3 - Broken Authentication vulnerability

Vendor Imran Sayed
Product Headless CMS
Weakness CWE-862 · Missing authorization
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3.

Key dates

02Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-6171 Missing Authorization in GitLab CVE-2023-47820 WordPress WP Like Button plugin <= 1.7.0 - Broken Access Control vulnerability CVE-2022-38057 WordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerability CVE-2024-1798 Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml CVE-2025-66058 WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability