CVE-2023-51418 HIGH

CVE-2023-51418: WordPress JVM rich text icons plugin <= 1.2.6 - Arbitrary File Deletion vulnerability

Vendor Joris Van Montfort
Product JVM rich text icons
Weakness CWE-862 · Missing authorization
Published April 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Missing Authorization vulnerability in Joris van Montfort JVM rich text icons.This issue affects JVM rich text icons: from n/a through 1.2.6.

Explanation of Vulnerability in Simple Terms

02Summary

JVM rich text icons versions up to 1.2.6 lack proper authorization checks, allowing authenticated users to trigger a denial-of-service condition affecting the entire application. An attacker with low-level account access can make the site unresponsive without needing user interaction. The vulnerability impacts availability across the system due to its changed scope.

What an attacker can do

03Attacker Capabilities

Make the site unresponsive or unavailable by triggering a denial-of-service condition.

Potential impact on your site

04Site Impact

Authenticated users can crash or disable your site without admin privileges; service disruption affects all visitors.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

April 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-15411 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action CVE-2026-16774 WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action CVE-2026-59522 WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability CVE-2026-65484 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability CVE-2026-13110 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action