CVE-2023-6985

The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.

Score

CVSS 3.1 8.8 High

Status

Modified - security@wordfence.com

Published

2024-02-05

Last modified

2026-04-08

Weaknesses

CWE-862

Affected products

• 10web Ai Assistant Ai Content Writing Assistant (10web)
• Ai Assistant (10web)

References

• https://plugins.trac.wordpress.org/changeset/3027004/ai-assistant-by-10web/trunk/ai-assistant-by-10web.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/229245a5-468d-47b9-8f26-d23d593e91da?source=cve