VulnSocial

CVE-2023-0556Disclosure(contentstudio / contentstudio)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.

contentstudio CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • contentstudio

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
contentstudio
Products
contentstudio

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-08: 1Technical Details · 2026-04-08: 104-08
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2023-0556: ContentStudio <= 1.2.5 - Missing ... Unauthenticated token extraction leads to full WordPress site takeover - classic auth bypass with a 9.8 CVSS that scream... https://zerodaysignal.com/vulnerability/CVE-2023-0556 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The statement announces CVE‑2023‑0556, detailing an unauthenticated token extraction that allows WordPress takeover and a 9.8 CVSS score.

    0000051
    204 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appcontentstudiocontentstudio-wordpress-

Explore more

Back to dashboardcontentstudio CVEscontentstudio vulnerabilities