CVE-2023-6389

medium · 6.1

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

6.1

CVSS

26.8%

EPSS (exploit prob.)

98th

EPSS percentile

2024-01-29

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-601

Affected products

Vendor	Product	Affected versions
abhinavsingh	wordpress_toolbar	<= 2.2.6

Check a specific version with /api/v1/cve/match.

References

https://magos-securitas.com/txt/CVE-2023-6389.txt
https://wpscan.com/vulnerability/04dafc55-3a8d-4dd2-96da-7a8b100e5a81/
https://magos-securitas.com/txt/CVE-2023-6389.txt
https://wpscan.com/vulnerability/04dafc55-3a8d-4dd2-96da-7a8b100e5a81/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-6389