CVE-2023-47693

CVE-2023-47693 is a missing authorization vulnerability (CWE-862) in the Themefic Ultimate Addons for Contact Form 7 WordPress plugin (ultimate-addons-for-contact-form-7). It enables exploiting incorrectly configured access control security levels and affects all versions from n/a through 3.2.6. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high severity primarily due to its potential for high confidentiality impact over the network.

Unauthenticated attackers (PR:N) can exploit this issue remotely (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation allows attackers to bypass authorization checks, potentially leading to unauthorized access to sensitive data (C:H) while maintaining an unchanged scope (S:U) and without impacting integrity or availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultimate-addons-for-contact-form-7-plugin-3-2-5-broken-access-control-vulnerability?_s_id=cve provides further details on this broken access control vulnerability in the plugin.