What’s Vulnerable › Vulnerabilities

CVE-2023-3601: Simple Author Box < 2.52 - Contributor+ Arbitrary User Information Disclosure via IDOR

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-08-14 · updated 2026-06-17

Description

The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.

Affected products

• Simple Author Box: before 2.52 — fixed in 2.52

How to fix

Upgrade to a fixed version: Simple Author Box 2.52. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/c0cc513e-c306-4920-9afb-e33d95a7292f
• https://wpscan.com/vulnerability/c0cc513e-c306-4920-9afb-e33d95a7292f

Get alerted when CVE-2023-3601 or the next vulnerability affects your stack