{"api_version":"1","generated_at":"2026-05-01T15:57:58+00:00","cve":"CVE-2023-41689","urls":{"html":"https://cve.report/CVE-2023-41689","api":"https://cve.report/api/cve/CVE-2023-41689.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-41689","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-41689"},"summary":{"title":"WordPress Post to Google My Business (Google Business Profile) plugin <= 3.1.14 - Broken Access Control vulnerability","description":"Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14.","state":"PUBLISHED","assigner":"Patchstack","published_at":"2024-12-13 15:15:23","updated_at":"2026-04-28 19:21:17"},"problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":[{"version":"3.1","source":"audit@patchstack.com","type":"Secondary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/post-to-google-my-business/vulnerability/wordpress-post-to-google-my-business-google-business-profile-plugin-3-1-14-broken-access-control-vulnerability?_s_id=cve","name":"https://patchstack.com/database/wordpress/plugin/post-to-google-my-business/vulnerability/wordpress-post-to-google-my-business-google-business-profile-plugin-3-1-14-broken-access-control-vulnerability?_s_id=cve","refsource":"audit@patchstack.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":""},{"url":"https://patchstack.com/database/Wordpress/Plugin/post-to-google-my-business/vulnerability/wordpress-post-to-google-my-business-google-business-profile-plugin-3-1-14-broken-access-control-vulnerability?_s_id=cve","name":"https://patchstack.com/database/wordpress/plugin/post-to-google-my-business/vulnerability/wordpress-post-to-google-my-business-google-business-profile-plugin-3-1-14-broken-access-control-vulnerability?_s_id=cve","refsource":"MITRE","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41689","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41689","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Koen Reus","product":"Post to Google My Business (Google Business Profile)","version":"affected n/a 3.1.14 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Update the WordPress Post to Google My Business (Google Business Profile) plugin to the latest available version (at least 3.1.15).","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Abdi Pranata (Patchstack Alliance)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2023","cve_id":"41689","cve":"CVE-2023-41689","epss":"0.001830000","percentile":"0.397130000","score_date":"2026-04-30","updated_at":"2026-05-01 00:10:54"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2023-41689","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-12-13T18:13:54.187736Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-12-13T18:14:13.527Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"post-to-google-my-business","product":"Post to Google My Business (Google Business Profile)","vendor":"Koen Reus","versions":[{"changes":[{"at":"3.1.15","status":"unaffected"}],"lessThanOrEqual":"3.1.14","status":"affected","version":"n/a","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Abdi Pranata (Patchstack Alliance)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.</p><p>This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14.</p>"}],"value":"Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14."}],"impacts":[{"capecId":"CAPEC-180","descriptions":[{"lang":"en","value":"CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-28T16:08:38.488Z","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","shortName":"Patchstack"},"references":[{"tags":["vdb-entry"],"url":"https://patchstack.com/database/wordpress/plugin/post-to-google-my-business/vulnerability/wordpress-post-to-google-my-business-google-business-profile-plugin-3-1-14-broken-access-control-vulnerability?_s_id=cve"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update the WordPress Post to Google My Business (Google Business Profile) plugin to the latest available version (at least 3.1.15)."}],"value":"Update the WordPress Post to Google My Business (Google Business Profile) plugin to the latest available version (at least 3.1.15)."}],"source":{"discovery":"EXTERNAL"},"title":"WordPress Post to Google My Business (Google Business Profile) plugin <= 3.1.14 - Broken Access Control vulnerability","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","assignerShortName":"Patchstack","cveId":"CVE-2023-41689","datePublished":"2024-12-13T14:24:14.283Z","dateReserved":"2023-08-30T15:05:59.970Z","dateUpdated":"2026-04-28T16:08:38.488Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-12-13 15:15:23","lastModifiedDate":"2026-04-28 19:21:17","problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"41689","Ordinal":"1","Title":"WordPress Post to Google My Business (Google Business Profile) p","CVE":"CVE-2023-41689","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"41689","Ordinal":"1","NoteData":"Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14.","Type":"Description","Title":"WordPress Post to Google My Business (Google Business Profile) p"}]}}}