CVE-2023-6029: EazyDocs < 2.3.6 - Unauthenticated Arbitrary Posts Deletion and Document Management

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-15 · updated 2026-06-17
Weakness: CWE-862

Description

The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections.

Affected products

EazyDocs: before 2.3.6 — fixed in 2.3.6

How to fix

Upgrade to a fixed version: EazyDocs 2.3.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e
https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e

Get alerted when CVE-2023-6029 or the next vulnerability affects your stack