CVE-2023-36681 is a medium severity missing authorization flaw (CVSS 5.3) in the Cool Plugins Cryptocurrency Widgets (Price Ticker and Coins List) plugin for WordPress, affecting versions through 2.6.2. The record lists no fixed version, so update to the newest release from the vendor and read its changelog.
What's affected
- Product: Cryptocurrency Widgets (Price Ticker and Coins List) by Cool Plugins, a WordPress plugin.
- Affected versions: from n/a through 2.6.2, which is the range the NVD record gives.
- Fixed version: not stated in the record. The Patchstack entry the record points to could not be retrieved when this post was written, so check the plugin changelog and that entry for the first patched release.
- Severity: Medium, CVSS 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
- Exploited in the wild: the record's CISA KEV flag is false.
The scoring vector tells you who can reach the problem. Attack vector is the network, attack complexity is low, and the privilege requirement is no account at all. User interaction is not needed.
Impact is rated on availability (low).
How to check if you're exposed
On the WordPress server, WP-CLI can list the installed version of the plugin:
wp plugin list --fields=name,status,version
wp plugin get cryptocurrency-price-ticker-widget --fields=name,status,version
If you do not use WP-CLI, open the Plugins page in the WordPress admin and read the version under the Cryptocurrency Widgets entry. A version at or below 2.6.2 is in the affected range. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
What to do now
- Find every WordPress site you run that has Cryptocurrency Widgets installed, including staging copies and sites managed by agencies.
- Update the plugin to the latest release from the vendor. Because the record gives no fixed version, confirm in the changelog that the release postdates the affected range (above 2.6.2).
- If you cannot update yet, deactivate and remove the plugin where it is not needed, or limit who can hold accounts on the site.
- Review user accounts. This weakness is reachable with no account at all, so remove stale accounts and tighten registration settings.
- Look through site logs and recent content or settings changes for anything you did not make, and take a backup before any change.
Why it matters
The weakness class is CWE-862, missing authorization. A function in the plugin does not confirm that the caller is allowed to use it. The user is signed in, or in some cases not even that, and the code never asks whether their role permits the action.
Plugins that add features on top of WordPress register many actions and endpoints, and each one needs its own capability check. When one is missed, the damage depends on what that function does. The record does not say which function, so treat the CVSS impact ratings as your guide: availability (low).
Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.
Quick check
Is there a fixed version?
The NVD record only gives the affected range, through 2.6.2. It does not name a patched release. Check the plugin changelog and the Patchstack entry, and update to the newest version available.
Do attackers need an account?
Per the CVSS vector, the privilege requirement is no account at all. That is why account hygiene on the site matters even before you can patch.
Sources
- NVD record for CVE-2023-36681
- Safeguard Gold page
- Patchstack entry cited by the record (could not be retrieved at the time of writing)
Last reviewed: 19 October 2026.
