What is the CVSS score of CVE-2023-6883?

CVE-2023-6883 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Easy Social Feed are affected by CVE-2023-6883?

Organizations using Easy Social Feed should be aware of moderate risk from CVE-2023-6883, a incorrect permissions vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2023-6883?

During next maintenance window: Identify affected systems running for WordPress is vulnerable to unauthorized modification of and apply vendor patches when convenient. Review and tighten file/resource permissions.

Easy Social Feed CVE-2023-6883

MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2024-01-11 security@wordfence.com

WordPress Authentication Bypass Easy Social Feed Wordpress Plugin Easysocialfeed

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:34 vuln.today

CVE Published

Jan 11, 2024 - 07:15 nvd

MEDIUM 4.3

DescriptionCVE.org

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's Facebook and Instagram access tokens and updating group IDs.

AnalysisAI

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions, such as modifying the plugin's Facebook and Instagram access tokens and updating group IDs. Affected products include: Easysocialfeed Easy Social Feed.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and restrict file/resource permissions, apply principle of least privilege.