{"id":"CVE-2023-6985","aliases":["EUVD-2023-59177","GHSA-47q6-36gc-6phg"],"status":"published","title":"10Web AI Assistant – AI content writing assistant \u003c= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation","description":"The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01354,"percentile":0.71994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-862"],"published":"2024-02-05T21:21:36Z","modified":"2026-06-17T06:51:49Z","exploits":[{"source":"pocgithub","id":"RandomRobbieBF/CVE-2023-6985","title":"RandomRobbieBF/CVE-2023-6985","date":"2024-01-29","url":"https://github.com/RandomRobbieBF/CVE-2023-6985"}],"products":[{"vendor":"10web","product":"10web ai assistant – ai content writing assistant"},{"vendor":"10web","product":"ai_assistant"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/229245a5-468d-47b9-8f26-d23d593e91da?source=cve","tags":["x_transferred","Patch","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/3027004/ai-assistant-by-10web/trunk/ai-assistant-by-10web.php","tags":["x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6985"},{"url":"https://github.com/advisories/GHSA-47q6-36gc-6phg"}],"sources":{"cve":[{"id":"CVE-2023-6985","title":"10Web AI Assistant – AI content writing assistant \u003c= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation","description":"The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.","status":"published","published":"2024-02-05T21:21:36.98Z","modified":"2026-04-08T16:41:42.21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:35:25.469654Z"}],"euvd":[{"id":"EUVD-2023-59177","description":"The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.","status":"published","published":"2024-02-05T21:21:36Z","modified":"2026-04-08T16:41:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:06.507675Z"}],"ghsa":[{"id":"GHSA-47q6-36gc-6phg","title":"The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to...","description":"The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.","status":"published","published":"2024-02-06T00:30:26Z","modified":"2026-03-22T05:07:43Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:06:46.535326Z"}],"nvd":[{"id":"CVE-2023-6985","description":"The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.","status":"published","published":"2024-02-05T22:15:58.433Z","modified":"2026-06-17T06:51:49.033Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:09:04.527564Z"}]}}