CVE-2023-4242 - CVE House
Back to Database
Status published Medium CVE-2023-4242

FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check

Vulnerability Description

The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-4242

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ramuel Gall

References

More from fullservices

View All →
CVE-2024-9211
FULL – Cliente <= 3.1.22 - Reflected Cross-Site Scripting
Medium 6.1
CVE-2024-6447
FULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter
High 7.2
CVE-2024-12023
FULL – Cliente 3.1.5 - 3.1.25 - Authenticated (Subscriber+) SQL Injection
Medium 6.5
CVE-2023-4243
FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation
High 8.8

Affected Vendor

fullservices

View all reports →

Affected Software

FULL – Cliente
Vulnerable Versions:
0

Timeline

Official Publish: August 9th, 2023
Last Modified: April 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access