CVE-2023-6279 is a High severity (CVSS 7.1) missing authorization flaw in the Woostify Sites Library WordPress plugin before 1.4.8. Any logged in user, even a subscriber, can update arbitrary site options, which can cause a denial of service. Update to version 1.4.8 or later.
What's affected
The NVD description and WPScan give the details.
- Affected: Woostify Sites Library before 1.4.8.
- Fixed: 1.4.8, according to WPScan's "Fixed in" field.
- Access needed: an authenticated account. The description says "any authenticated users, such as subscriber", which is the lowest standard WordPress role.
- Severity: 7.1 High. WPScan lists the same score. The weakness class is CWE-862, missing authorization.
- Impact: an attacker can set arbitrary blog options to an activated value, which could break the site when a specific option name is used.
The researcher credited by WPScan is Krzysztof Zając of CERT Polska. The kev flag is false.
How to check if you're exposed
Check the plugin version on each site.
wp plugin list --fields=name,status,version | grep woostify-sites-library
wp plugin update woostify-sites-library
Sites that allow open registration are more exposed, because anyone can create a subscriber account. Check your user list for subscriber accounts you did not expect, and check whether registration is turned on in the General settings.
If a site went down for no clear reason around the time of an unfamiliar login, look at the options table for recently changed rows.
What to do now
- Update Woostify Sites Library to 1.4.8 or later on every site.
- If you do not use the plugin, remove it. Starter site libraries are often needed only during setup.
- Turn off open user registration unless you need it, and review existing subscriber accounts.
- Check the options table for unexpected changes if a site has failed without explanation.
- Add plugins that expose AJAX actions to your review list. Authorization checks are a common gap there.
Why it matters
The weakness is CWE-862. The plugin exposes an AJAX action to any logged in user and never checks whether that user is allowed to change site options. WordPress separates the question of being logged in from the question of being allowed to do something, and the plugin only asked the first one.
The impact is limited to availability according to the description, but the root cause is more serious than that. An action that writes arbitrary options is a powerful capability to leave open. In this case the sources describe only denial of service. The kev flag is false, and no exploitation in the wild is reported.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do attackers need an administrator account?
No. A subscriber account is enough, according to the description.
Which version fixes it?
1.4.8, per WPScan.
Sources
Last reviewed: 19 October 2026.
