EazyDocs 2.3.8 - 2.3.9 - Missing Authorization

Wordfence Intelligence   >   Vulnerability Database   >   EazyDocs 2.3.8 - 2.3.9 - Missing Authorization
4.3
Missing Authorization
CVE CVE-2024-0248
CVSS 4.3 (Medium)
Publicly Published December 21, 2023
Last Updated March 22, 2024
Researcher Dao Xuan Hieu

Description

The EazyDocs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on various functions in versions 2.3.8 to 2.3.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts and add/delete documents and sections.

References

Share

Vulnerability Details for EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder

EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder

Software Type Plugin
Software Slug eazydocs (view on wordpress.org)
Patched? Yes
Remediation Update to version 2.4.0, or a newer patched version
Affected Version
  • 2.3.8 - 2.3.9
Patched Version
  • 2.4.0

Recent vulnerabilities in EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVE-2024-13362
Apr 30, 2026
Researcher: Asaf Mozes
EazyDocs <= 2.7.1 - Missing Authorization
4.3
CVE-2025-32221
Apr 7, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
EazyDocs <= 2.8.0 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2024-54376
Dec 11, 2024
Researcher: kslatz
EazyDocs <= 2.5.0 - Missing Authorization
4.3
CVE-2024-38721
Jul 11, 2024
Researcher: Khalid
EazyDocs <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-38720
Jul 11, 2024
Researcher: Khalid
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin <= 2.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-3999
Jun 11, 2024
Researcher: Aditya Vyawahare
EazyDocs <= 2.3.3 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2023-6035
Nov 20, 2023
Researcher: Dao Xuan Hieu
EazyDocs <= 2.3.5 - Missing Authorization via doc_one_page and edit_doc_one_page
6.5
CVE-2023-47648
Nov 7, 2023
Researcher: Skalucy
EazyDocs <= 2.3.5 - Unauthenticated Stored Cross-Site Scripting via edit_doc_one_page
6.1
CVE-2023-47549
Nov 7, 2023
Researcher: minhtuanact
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
6.1
CVE-2023-33999
Jul 18, 2023
Researcher: Rafie Muhammad
# Title CVE ID CVSS Researchers Date
1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 Asaf Mozes April 30, 2026
2 EazyDocs <= 2.7.1 - Missing Authorization CVE-2025-32221 4.3 Trương Hữu Phúc (truonghuuphuc) April 7, 2025
3 EazyDocs <= 2.8.0 - Authenticated (Contributor+) Local File Inclusion CVE-2024-54376 8.8 kslatz December 11, 2024
4 EazyDocs <= 2.5.0 - Missing Authorization CVE-2024-38721 4.3 Khalid July 11, 2024
5 EazyDocs <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-38720 6.4 Khalid July 11, 2024
6 EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin <= 2.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-3999 4.4 Aditya Vyawahare June 11, 2024
7 EazyDocs <= 2.3.3 - Authenticated (Subscriber+) SQL Injection CVE-2023-6035 8.8 Dao Xuan Hieu November 20, 2023
8 EazyDocs <= 2.3.5 - Missing Authorization via doc_one_page and edit_doc_one_page CVE-2023-47648 6.5 Skalucy November 7, 2023
9 EazyDocs <= 2.3.5 - Unauthenticated Stored Cross-Site Scripting via edit_doc_one_page CVE-2023-47549 6.1 minhtuanact November 7, 2023
10 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVE-2023-33999 6.1 Rafie Muhammad July 18, 2023
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation