CVE-2023-2173

CVE-2023-2173 is an Insecure Direct Object Reference vulnerability affecting the BadgeOS plugin for WordPress, versions up to and including 3.7.1.6. It allows authenticated attackers with subscriber-level permissions or higher to delete arbitrary posts due to insufficient validation and authorization checks in several AJAX handler functions. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network attack vector with low complexity, requiring low privileges, and resulting in low integrity impact (deletion of posts). There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.