CVE-2023-36683 MEDIUM

CVE-2023-36683: WordPress Schema Pro plugin <= 2.7.8 - Broken Access Control vulnerability

Vendor Wp Schema Pro

Product Schema Pro

Weakness CWE-862 · Missing authorization

Published June 19, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in WP SCHEMA PRO Schema Pro.This issue affects Schema Pro: from n/a through 2.7.8.

Explanation of Vulnerability in Simple Terms

02Summary

Schema Pro versions up to 2.7.8 lack proper authorization checks, allowing an attacker to read sensitive data by visiting a malicious link. The vulnerability requires user interaction—the victim must click a link or visit a page controlled by the attacker. No authentication is needed. The attacker gains access to confidential information but cannot modify or disable the site.

What an attacker can do

03Attacker Capabilities

Read sensitive data from the site by tricking a user into visiting a malicious link.

Potential impact on your site

04Site Impact

Confidential information may be exposed to attackers if users are tricked into clicking malicious links.

Conditions required to exploit

05Prerequisites

Victim must click an attacker-controlled link or visit a page the attacker directs them to.

Key dates

06Disclosure timeline

June 19, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-36683 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities