What’s Vulnerable › Vulnerabilities

CVE-2023-1868: YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Reset

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-05 · updated 2026-06-17
• Weakness: CWE-862

Description

The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_clear_cache GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to clear the plugin's cache.

Affected products

• pluginbuilders YourChannel: Everything you want in a YouTube plugin.: through 1.2.3

References

• https://plugins.trac.wordpress.org/browser/yourchannel/trunk/YourChannel.php?rev=2844975#L768
• https://plugins.trac.wordpress.org/changeset/2896634/yourchannel/trunk?contextall=1&old=2844975&old_path=%2Fyourchannel%2Ftrunk
• https://wordpress.org/plugins/yourchannel/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/541d202b-f3ed-44d8-93a6-e158209db885?source=cve
• https://plugins.trac.wordpress.org/browser/yourchannel/trunk/YourChannel.php?rev=2844975#L768
• https://wordpress.org/plugins/yourchannel/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/541d202b-f3ed-44d8-93a6-e158209db885?source=cve

Get alerted when CVE-2023-1868 or the next vulnerability affects your stack