CVE-2023-1979 - Web Stories for WordPress Plugin
CVE-2023-1979
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68
CVE-2023-1979
MEDIUM
CVSS 4.9
Published 2023-05-08
Updated 2024-11-21
AI Risk Moderate (53/100)
Active Exploit: No strong signal
Published Exploit: Public exploit references found
Priority: P4 Planned
Severity Band
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected Components
1
Reference Links
2
AI Risk Engine
Moderate (53/100)
Exploitability
Medium
Active Exploitation
No strong signal
Published Exploit Status
Public exploit references found
AI Context
Machine-generated threat intelligence
AI
Updated 128 days ago
AI enriched 128 days ago (2026-04-12 02:26 UTC)
Technical Summary
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly…
Potential Impact
Severity is MEDIUM (CVSS 4.9). Depending on deployment context, affected components may be exposed to unauthorized actions or data integrity risk.
Exploitability Assessment
Exploitability is assessed as Medium based on published exploit references.
Primary risk drivers: published exploit references
Mitigation Recommendations
Validate affected product versions, prioritize patching, and monitor references for vendor remediation guidance. If immediate patching is not possible, apply compensating controls and limit exposure of vulnerable surfaces.
Detection & Monitoring
Track authentication anomalies, unexpected file writes, and suspicious plugin API activity around affected components.
Business Impact Lens
AI risk score 53/100 (Moderate, Medium) with priority P4 Planned. Prioritize remediation where affected components process customer data, admin sessions, or Internet-exposed workflows.
