{
  "GSD": {
    "alias": "CVE-2023-6048",
    "id": "GSD-2023-6048"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-6048"
      ],
      "details": "The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site\u0027s options to 1, which could be used to break sites and lead to DoS when certain options are reset",
      "id": "GSD-2023-6048",
      "modified": "2023-12-13T01:20:32.628717Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "contact@wpscan.com",
        "ID": "CVE-2023-6048",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Estatik Real Estate Plugin",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0",
                          "version_value": "4.1.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Unknown"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Krzysztof Zaj\u0105c (CERT PL)"
        },
        {
          "lang": "en",
          "value": "WPScan"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site\u0027s options to 1, which could be used to break sites and lead to DoS when certain options are reset"
          }
        ]
      },
      "generator": {
        "engine": "WPScan CVE Generator"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-862 Missing Authorization"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://wpscan.com/vulnerability/74cb07fe-fc82-472f-8c52-859c176d9e51",
            "refsource": "MISC",
            "url": "https://wpscan.com/vulnerability/74cb07fe-fc82-472f-8c52-859c176d9e51"
          }
        ]
      },
      "source": {
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:estatik:estatik:*:*:*:*:*:wordpress:*:*",
                    "matchCriteriaId": "6D2F1F48-7409-419C-BAB4-7B6B03E6A0B7",
                    "versionEndExcluding": "4.1.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from setting any of the site\u0027s options to 1, which could be used to break sites and lead to DoS when certain options are reset"
          },
          {
            "lang": "es",
            "value": "El complemento de WordPress Estatik Real Estate Plugin anterior a 4.1.1 no impide que los usuarios con privilegios bajos en el sitio, como los suscriptores, establezcan cualquiera de las opciones del sitio en 1, lo que podr\u00eda usarse para interrumpir sitios y provocar DoS cuando ciertas opciones se reinician"
          }
        ],
        "id": "CVE-2023-6048",
        "lastModified": "2024-01-19T18:09:11.130",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-01-15T16:15:12.280",
        "references": [
          {
            "source": "contact@wpscan.com",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://wpscan.com/vulnerability/74cb07fe-fc82-472f-8c52-859c176d9e51"
          }
        ],
        "sourceIdentifier": "contact@wpscan.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}