CVE-2023-40678 MEDIUM

CVE-2023-40678: WordPress Simple URLs plugin <= 117 - Broken Access Control vulnerability

Vendor Andrew Fiebert

Product Simple URLs

Weakness CWE-862 · Missing authorization

Published December 13, 2024

Last update May 11, 2026

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in Andrew Fiebert Simple URLs simple-urls allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple URLs: from n/a through <= 117.

Key dates

02Disclosure timeline

December 13, 2024 CVE published

May 11, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-40678 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2025-10583 WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery CVE-2023-51672 WordPress FunnelKit Checkout plugin <= 3.10.3 - Unauthenticated Arbitrary Post/Page Deletion vulnerability CVE-2025-64257 WordPress My Tickets plugin <= 2.1.0 - Broken Access Control vulnerability CVE-2025-52800 WordPress The E-Commerce ERP <= 2.1.1.3 - Broken Access Control Vulnerability CVE-2026-25517 Wagtail has improper permission handling on admin preview endpoints