CVE-2023-36684 is a high severity missing authorization flaw (CVSS 7.1) in the Brainstorm Force Convert Pro plugin for WordPress, affecting versions through 1.7.5. The record lists no fixed version, so update to the newest release from the vendor and read its changelog.
What's affected
- Product: Convert Pro by Brainstorm Force, a WordPress plugin.
- Affected versions: from n/a through 1.7.5, which is the range the NVD record gives.
- Fixed version: not stated in the record. The Patchstack entry the record points to could not be retrieved when this post was written, so check the plugin changelog and that entry for the first patched release.
- Severity: High, CVSS 7.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.
- Exploited in the wild: the record's CISA KEV flag is false.
The scoring vector tells you who can reach the problem. Attack vector is the network, attack complexity is low, and the privilege requirement is no account at all.
Impact is rated on confidentiality (low), integrity (high).
How to check if you're exposed
On the WordPress server, WP-CLI can list the installed version of the plugin:
wp plugin list --fields=name,status,version
wp plugin get convertpro --fields=name,status,version
If you do not use WP-CLI, open the Plugins page in the WordPress admin and read the version under the Convert Pro entry. A version at or below 1.7.5 is in the affected range. Inactive plugins still sit on disk, so remove ones you do not use instead of leaving them deactivated.
Convert Pro is a premium plugin, so updates may come through the vendor account instead of the WordPress.org directory. Check the licence and update panel in the admin.
What to do now
- Find every WordPress site you run that has Convert Pro installed, including staging copies and sites managed by agencies.
- Update the plugin to the latest release from the vendor. Because the record gives no fixed version, confirm in the changelog that the release postdates the affected range (above 1.7.5).
- If you cannot update yet, deactivate and remove the plugin where it is not needed, or limit who can hold accounts on the site.
- Review user accounts. This weakness is reachable with no account at all, so remove stale accounts and tighten registration settings.
- Look through site logs and recent content or settings changes for anything you did not make, and take a backup before any change.
Why it matters
The weakness class is CWE-862, missing authorization. A function in the plugin does not confirm that the caller is allowed to use it. The user is signed in, or in some cases not even that, and the code never asks whether their role permits the action.
Plugins that add features on top of WordPress register many actions and endpoints, and each one needs its own capability check. When one is missed, the damage depends on what that function does. The record does not say which function, so treat the CVSS impact ratings as your guide: confidentiality (low), integrity (high).
Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.
Quick check
Is there a fixed version?
The NVD record only gives the affected range, through 1.7.5. It does not name a patched release. Check the plugin changelog and the Patchstack entry, and update to the newest version available.
Do attackers need an account?
Per the CVSS vector, the privilege requirement is no account at all. That is why account hygiene on the site matters even before you can patch.
Sources
- NVD record for CVE-2023-36684
- Safeguard Gold page
- Patchstack entry cited by the record (could not be retrieved at the time of writing)
Last reviewed: 19 October 2026.
