CVE-2023-36684 HIGH

CVE-2023-36684: WordPress Convert Pro plugin <= 1.7.5 - Broken Access Control vulnerability

Vendor Brainstorm Force

Product Convert Pro

Weakness CWE-862 · Missing authorization

Published June 19, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5.

Explanation of Vulnerability in Simple Terms

02Summary

Convert Pro versions up to 1.7.5 lack proper authorization checks, allowing an attacker to modify site content if a user visits a malicious link. The vulnerability requires user interaction but can result in unauthorized changes to the site. Site administrators should update to a version newer than 1.7.5 to remediate this issue.

What an attacker can do

03Attacker Capabilities

Modify site content or settings if a user clicks a malicious link.

Potential impact on your site

04Site Impact

Unauthorized changes to site content, forms, or settings without your knowledge or consent.

Conditions required to exploit

05Prerequisites

No authentication required, but the victim must click an attacker-supplied link.

Key dates

06Disclosure timeline

June 19, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-36684 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities