What’s Vulnerable › Vulnerabilities

CVE-2023-0336: OoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment Deletion

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-27 · updated 2026-06-17
• Weakness: CWE-352

Description

The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.

Affected products

• sagarpatel124 OoohBoi Steroids for Elementor: before 2.1.5 — fixed in 2.1.5

How to fix

Upgrade to a fixed version: sagarpatel124 OoohBoi Steroids for Elementor 2.1.5. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/ac74df9a-6fbf-4411-a501-97eba1ad1895
• https://wpscan.com/vulnerability/ac74df9a-6fbf-4411-a501-97eba1ad1895

Get alerted when CVE-2023-0336 or the next vulnerability affects your stack