CVE-2023-2066

CVE-2023-2066 is a medium-severity vulnerability affecting the Announcement & Notification Banner – Bulletin plugin for WordPress, versions up to and including 3.6.0. It allows authenticated attackers with subscriber-level access or higher to bypass capability checks on several functions, leading to unauthorized data modification. This includes altering plugin settings, modifying existing bulletins, and creating new ones. The vulnerability has a CVSS score of 4.3 (Medium), indicating a low attack complexity and requiring only low privileges for exploitation. The potential impact is limited to unauthorized modification of data (Integrity impact Low), with no confidentiality or availability impact. Currently, there is no evidence of active exploitation, nor are there publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting low awareness and a lack of widespread attention.