CVE-2023-37869 is a medium severity (CVSS 6.5) missing authorization flaw in the Premium Addons PRO plugin for WordPress, in versions through 2.9.0. A logged in user with low privileges can reach a function that should be restricted, with a high availability impact. Update the plugin and confirm the fixed release in the vendor notes.
What's affected
The NVD record lists Premium Addons PRO as affected "from n/a through 2.9.0", which is Patchstack wording for every release up to and including 2.9.0. The record scores the flaw 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The weakness is tracked as CWE-862 (missing authorization).
The vector says the attack is made over the network, needs only a low privilege account and no user interaction, and affects availability (A:H) while leaving confidentiality and integrity untouched. So the stated impact is about disrupting the site, not reading or changing data. The Patchstack reference title calls the issue a broken access control vulnerability, which matches the weakness class.
The record names no fixed version, and the Patchstack page it links to could not be retrieved when we reviewed it (Patchstack blocked our request). The CVE is not flagged in CISA KEV in the record, and nothing we read says it is exploited in the wild. For the fixed release, check the vendor changelog or the Patchstack entry.
How to check if you're exposed
If you run WP-CLI, list the installed version and status of the plugin:
wp plugin list --fields=name,version,status,update
Look for Premium Addons PRO in the output. Anything at 2.9.0 or lower is in the affected range. In the dashboard the same information is under Plugins, Installed Plugins. On a fleet of sites, run the command per site or through your management tool, and include staging and forgotten test copies.
You can also check your dependency manifests and images. A free in-browser scan at gold.safeguard.sh/scan takes a package.json, a requirements.txt or an SBOM and shows known CVEs, though WordPress plugins are usually tracked by the CMS rather than a package manager, so keep a separate list of them.
What to do now
- List every WordPress site you run and note whether Premium Addons PRO is installed and at what version.
- Update Premium Addons PRO to the newest release the vendor offers. If the update is behind a license, renew it or plan the change, because the old version stays vulnerable.
- If you cannot update today, deactivate the plugin on sites where it is not needed, or restrict access to the affected features with a web application firewall rule from your provider.
- Review user accounts and recent changes on any site that ran the affected version for a while, and remove accounts you do not recognise.
- Add the plugin to a watch list so the next advisory reaches you the day it is published.
Why it matters
Missing authorization is one of the most common plugin flaws. A plugin registers an action, often for the dashboard or for AJAX requests, and the code checks that the request is well formed but never checks what the caller is allowed to do. Any account that can log in, even a subscriber, can then call something meant for administrators.
The score here is medium because the account requirement and the availability only impact limit the damage. On sites that let anyone register, that account requirement is weak protection. Check your registration settings and the roles you hand out by default.
Quick check
Does updating Premium Addons PRO fully fix this?
The vendor decides that, and the record does not name a fixed version. Update to the latest release, read the changelog and the Patchstack entry, and confirm the version number afterwards.
Is this being exploited?
The record does not flag CVE-2023-37869 as a CISA KEV entry, and the sources we could read do not report exploitation. That can change, so keep the plugin updated.
Sources
- Patchstack entry (linked from the NVD record; it could not be retrieved when we reviewed it)
- CVE-2023-37869 on Gold
Last reviewed: 19 October 2026.
