{"id":"CVE-2023-1979","summary":"Auth bypass in Web Stories for WordPress plugin","details":"The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the \"Author\" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit  ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 \n","modified":"2026-08-12T03:51:26.061715473Z","published":"2023-05-08T16:28:53.574Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1979.json","cna_assigner":"Google","cwe_ids":["CWE-863"]},"references":[{"type":"WEB","url":"https://github.com/GoogleForCreators/web-stories-wp/releases/tag/v1.32.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1979.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1979"},{"type":"FIX","url":"https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68"},{"type":"PACKAGE","url":"https://github.com/GoogleForCreators/web-stories-wp"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/googleforcreators/web-stories-wp","events":[{"introduced":"0"},{"fixed":"b0fac56be92c6b4d2cafd0a2a9e06762203a74dd"},{"fixed":"ad49781c2a35c5c92ef704d4b621ab4e5cb77d68"}],"database_specific":{"cpe":"cpe:2.3:a:google:web_stories:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.32.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["url-v0.1.202303271448","units-v0.1.202303271448","transform-v0.1.202303271448","tracking-v0.1.202303271448","text-sets-v0.1.202303271448","templates-v0.1.202303271448","story-editor-v0.1.202303271448","stickers-v0.1.202303271448","rich-text-v0.1.202303271448","react-v0.1.202303271448","patterns-v0.1.202303271448","output-v0.1.202303271448","moveable-v0.1.202303271448","migration-v0.1.202303271448","media-v0.1.202303271448","masks-v0.1.202303271448","i18n-v0.1.202303271448","fonts-v0.1.202303271448","elements-v0.1.202303271448","element-library-v0.1.202303271448","dom-v0.1.202303271448","design-system-v0.1.202303271448","date-v0.1.202303271448","dashboard-v0.1.202303271448","animation-v0.1.202303271448","url-v0.1.202204141511","units-v0.1.202204141511","transform-v0.1.202204141511","tracking-v0.1.202204141511","text-sets-v0.1.202204141511","templates-v0.1.202204141511","story-editor-v0.1.202204141511","stickers-v0.1.202204141511","rich-text-v0.1.202204141511","react-v0.1.202204141511","patterns-v0.1.202204141511","output-v0.1.202204141511","moveable-v0.1.202204141511","migration-v0.1.202204141511","media-v0.1.202204141511","masks-v0.1.202204141511","i18n-v0.1.202204141511","fonts-v0.1.202204141511","elements-v0.1.202204141511","element-library-v0.1.202204141511","dom-v0.1.202204141511","design-system-v0.1.202204141511","date-v0.1.202204141511","dashboard-v0.1.202204141511","animation-v0.1.202204141511","url-v0.1.202203150806","units-v0.1.202203150806","transform-v0.1.202203150806","tracking-v0.1.202203150806","text-sets-v0.1.202203150806","templates-v0.1.202203150806","story-editor-v0.1.202203150806","stickers-v0.1.202203150806","rich-text-v0.1.202203150806","react-v0.1.202203150806","patterns-v0.1.202203150806","moveable-v0.1.202203150806","migration-v0.1.202203150806","media-v0.1.202203150806","i18n-v0.1.202203150806","fonts-v0.1.202203150806","dom-v0.1.202203150806","design-system-v0.1.202203150806","date-v0.1.202203150806","dashboard-v0.1.202203150806","animation-v0.1.202203150806","url-v0.1.202208291229","units-v0.1.202208291229","transform-v0.1.202208291229","tracking-v0.1.202208291229","text-sets-v0.1.202208291229","templates-v0.1.202208291229","story-editor-v0.1.202208291229","stickers-v0.1.202208291229","rich-text-v0.1.202208291229","react-v0.1.202208291229","patterns-v0.1.202208291229","output-v0.1.202208291229","moveable-v0.1.202208291229","migration-v0.1.202208291229","media-v0.1.202208291229","masks-v0.1.202208291229","i18n-v0.1.202208291229","fonts-v0.1.202208291229","elements-v0.1.202208291229","element-library-v0.1.202208291229","dom-v0.1.202208291229","design-system-v0.1.202208291229","date-v0.1.202208291229","dashboard-v0.1.202208291229","animation-v0.1.202208291229","url-v0.1.202302061326","units-v0.1.202302061326","transform-v0.1.202302061326","tracking-v0.1.202302061326","text-sets-v0.1.202302061326","templates-v0.1.202302061326","story-editor-v0.1.202302061326","stickers-v0.1.202302061326","rich-text-v0.1.202302061326","react-v0.1.202302061326","patterns-v0.1.202302061326","output-v0.1.202302061326","moveable-v0.1.202302061326","migration-v0.1.202302061326","media-v0.1.202302061326","masks-v0.1.202302061326","i18n-v0.1.202302061326","fonts-v0.1.202302061326","elements-v0.1.202302061326","element-library-v0.1.202302061326","dom-v0.1.202302061326","design-system-v0.1.202302061326","date-v0.1.202302061326","dashboard-v0.1.202302061326","animation-v0.1.202302061326","url-v0.1.202212071230","units-v0.1.202212071230","transform-v0.1.202212071230","tracking-v0.1.202212071230","text-sets-v0.1.202212071230","templates-v0.1.202212071230","story-editor-v0.1.202212071230","stickers-v0.1.202212071230","rich-text-v0.1.202212071230","react-v0.1.202212071230","patterns-v0.1.202212071230","output-v0.1.202212071230","moveable-v0.1.202212071230","migration-v0.1.202212071230","media-v0.1.202212071230","masks-v0.1.202212071230","i18n-v0.1.202212071230","fonts-v0.1.202212071230","elements-v0.1.202212071230","element-library-v0.1.202212071230","dom-v0.1.202212071230","design-system-v0.1.202212071230","date-v0.1.202212071230","dashboard-v0.1.202212071230","animation-v0.1.202212071230","url-v0.1.202203010801","units-v0.1.202203010801","transform-v0.1.202203010801","tracking-v0.1.202203010801","text-sets-v0.1.202203010801","templates-v0.1.202203010801","story-editor-v0.1.202203010801","stickers-v0.1.202203010801","rich-text-v0.1.202203010801","react-v0.1.202203010801","patterns-v0.1.202203010801","moveable-v0.1.202203010801","migration-v0.1.202203010801","media-v0.1.202203010801","i18n-v0.1.202203010801","fonts-v0.1.202203010801","dom-v0.1.202203010801","design-system-v0.1.202203010801","date-v0.1.202203010801","dashboard-v0.1.202203010801","animation-v0.1.202203010801","units-v0.1.202202071716","transform-v0.1.202202071716","tracking-v0.1.202202071716","text-sets-v0.1.202202071716","templates-v0.1.202202071716","story-editor-v0.1.202202071716","stickers-v0.1.202202071716","react-v0.1.202202071716","patterns-v0.1.202202071716","moveable-v0.1.202202071716","migration-v0.1.202202071716","media-v0.1.202202071716","i18n-v0.1.202202071716","fonts-v0.1.202202071716","design-system-v0.1.202202071716","date-v0.1.202202071716","dashboard-v0.1.202202071716","animation-v0.1.202202071716","url-v0.1.202208081316","units-v0.1.202208081316","transform-v0.1.202208081316","tracking-v0.1.202208081316","text-sets-v0.1.202208081316","templates-v0.1.202208081316","story-editor-v0.1.202208081316","stickers-v0.1.202208081316","rich-text-v0.1.202208081316","react-v0.1.202208081316","patterns-v0.1.202208081316","output-v0.1.202208081316","moveable-v0.1.202208081316","migration-v0.1.202208081316","media-v0.1.202208081316","masks-v0.1.202208081316","i18n-v0.1.202208081316","fonts-v0.1.202208081316","elements-v0.1.202208081316","element-library-v0.1.202208081316","dom-v0.1.202208081316","design-system-v0.1.202208081316","date-v0.1.202208081316","dashboard-v0.1.202208081316","animation-v0.1.202208081316","url-v0.1.202206271222","units-v0.1.202206271222","transform-v0.1.202206271222","tracking-v0.1.202206271222","text-sets-v0.1.202206271222","templates-v0.1.202206271222","story-editor-v0.1.202206271222","stickers-v0.1.202206271222","rich-text-v0.1.202206271222","react-v0.1.202206271222","patterns-v0.1.202206271222","output-v0.1.202206271222","moveable-v0.1.202206271222","migration-v0.1.202206271222","media-v0.1.202206271222","masks-v0.1.202206271222","i18n-v0.1.202206271222","fonts-v0.1.202206271222","elements-v0.1.202206271222","element-library-v0.1.202206271222","dom-v0.1.202206271222","design-system-v0.1.202206271222","date-v0.1.202206271222","dashboard-v0.1.202206271222","animation-v0.1.202206271222","url-v0.1.202203241635","units-v0.1.202203241635","transform-v0.1.202203241635","tracking-v0.1.202203241635","text-sets-v0.1.202203241635","templates-v0.1.202203241635","story-editor-v0.1.202203241635","stickers-v0.1.202203241635","rich-text-v0.1.202203241635","react-v0.1.202203241635","patterns-v0.1.202203241635","output-v0.1.202203241635","moveable-v0.1.202203241635","migration-v0.1.202203241635","media-v0.1.202203241635","masks-v0.1.202203241635","i18n-v0.1.202203241635","fonts-v0.1.202203241635","elements-v0.1.202203241635","element-library-v0.1.202203241635","dom-v0.1.202203241635","design-system-v0.1.202203241635","date-v0.1.202203241635","dashboard-v0.1.202203241635","animation-v0.1.202203241635","url-v0.1.202207041221","units-v0.1.202207041221","transform-v0.1.202207041221","tracking-v0.1.202207041221","text-sets-v0.1.202207041221","templates-v0.1.202207041221","story-editor-v0.1.202207041221","stickers-v0.1.202207041221","rich-text-v0.1.202207041221","react-v0.1.202207041221","patterns-v0.1.202207041221","output-v0.1.202207041221","moveable-v0.1.202207041221","migration-v0.1.202207041221","media-v0.1.202207041221","masks-v0.1.202207041221","i18n-v0.1.202207041221","fonts-v0.1.202207041221","elements-v0.1.202207041221","element-library-v0.1.202207041221","dom-v0.1.202207041221","design-system-v0.1.202207041221","date-v0.1.202207041221","dashboard-v0.1.202207041221","animation-v0.1.202207041221","url-v0.1.202212191259","units-v0.1.202212191259","transform-v0.1.202212191259","tracking-v0.1.202212191259","text-sets-v0.1.202212191259","templates-v0.1.202212191259","story-editor-v0.1.202212191259","stickers-v0.1.202212191259","rich-text-v0.1.202212191259","react-v0.1.202212191259","patterns-v0.1.202212191259","output-v0.1.202212191259","moveable-v0.1.202212191259","migration-v0.1.202212191259","media-v0.1.202212191259","masks-v0.1.202212191259","i18n-v0.1.202212191259","fonts-v0.1.202212191259","elements-v0.1.202212191259","element-library-v0.1.202212191259","dom-v0.1.202212191259","design-system-v0.1.202212191259","date-v0.1.202212191259","dashboard-v0.1.202212191259","animation-v0.1.202212191259","url-v0.1.202211151052","units-v0.1.202211151052","transform-v0.1.202211151052","tracking-v0.1.202211151052","text-sets-v0.1.202211151052","templates-v0.1.202211151052","story-editor-v0.1.202211151052","stickers-v0.1.202211151052","rich-text-v0.1.202211151052","react-v0.1.202211151052","patterns-v0.1.202211151052","output-v0.1.202211151052","moveable-v0.1.202211151052","migration-v0.1.202211151052","media-v0.1.202211151052","masks-v0.1.202211151052","i18n-v0.1.202211151052","fonts-v0.1.202211151052","elements-v0.1.202211151052","element-library-v0.1.202211151052","dom-v0.1.202211151052","design-system-v0.1.202211151052","date-v0.1.202211151052","dashboard-v0.1.202211151052","animation-v0.1.202211151052","v1.31.0-rc.1","v1.31.0","v1.30.0","v1.30.0-rc.1","v1.29.0-rc.2","v1.29.0","v1.29.0-rc.1","url-v0.1.202301231653","units-v0.1.202301231653","transform-v0.1.202301231653","tracking-v0.1.202301231653","text-sets-v0.1.202301231653","templates-v0.1.202301231653","story-editor-v0.1.202301231653","stickers-v0.1.202301231653","rich-text-v0.1.202301231653","react-v0.1.202301231653","patterns-v0.1.202301231653","output-v0.1.202301231653","moveable-v0.1.202301231653","migration-v0.1.202301231653","media-v0.1.202301231653","masks-v0.1.202301231653","i18n-v0.1.202301231653","fonts-v0.1.202301231653","elements-v0.1.202301231653","element-library-v0.1.202301231653","dom-v0.1.202301231653","design-system-v0.1.202301231653","date-v0.1.202301231653","dashboard-v0.1.202301231653","animation-v0.1.202301231653","v1.28.0-rc.1","v1.28.0","v1.27.0","v1.27.0-rc.1","v1.26.0-rc.1","v1.26.0","url-v0.1.202208151234","units-v0.1.202208151234","transform-v0.1.202208151234","tracking-v0.1.202208151234","text-sets-v0.1.202208151234","templates-v0.1.202208151234","story-editor-v0.1.202208151234","stickers-v0.1.202208151234","rich-text-v0.1.202208151234","react-v0.1.202208151234","patterns-v0.1.202208151234","output-v0.1.202208151234","moveable-v0.1.202208151234","migration-v0.1.202208151234","media-v0.1.202208151234","masks-v0.1.202208151234","i18n-v0.1.202208151234","fonts-v0.1.202208151234","elements-v0.1.202208151234","element-library-v0.1.202208151234","dom-v0.1.202208151234","design-system-v0.1.202208151234","date-v0.1.202208151234","dashboard-v0.1.202208151234","animation-v0.1.202208151234","url-v0.1.202206201534","units-v0.1.202206201534","transform-v0.1.202206201534","tracking-v0.1.202206201534","text-sets-v0.1.202206201534","templates-v0.1.202206201534","story-editor-v0.1.202206201534","stickers-v0.1.202206201534","rich-text-v0.1.202206201534","react-v0.1.202206201534","patterns-v0.1.202206201534","output-v0.1.202206201534","moveable-v0.1.202206201534","migration-v0.1.202206201534","media-v0.1.202206201534","masks-v0.1.202206201534","i18n-v0.1.202206201534","fonts-v0.1.202206201534","elements-v0.1.202206201534","element-library-v0.1.202206201534","dom-v0.1.202206201534","design-system-v0.1.202206201534","date-v0.1.202206201534","dashboard-v0.1.202206201534","animation-v0.1.202206201534","url-v0.1.202205021257","units-v0.1.202205021257","transform-v0.1.202205021257","tracking-v0.1.202205021257","text-sets-v0.1.202205021257","templates-v0.1.202205021257","story-editor-v0.1.202205021257","stickers-v0.1.202205021257","rich-text-v0.1.202205021257","react-v0.1.202205021257","patterns-v0.1.202205021257","output-v0.1.202205021257","moveable-v0.1.202205021257","migration-v0.1.202205021257","media-v0.1.202205021257","masks-v0.1.202205021257","i18n-v0.1.202205021257","fonts-v0.1.202205021257","elements-v0.1.202205021257","element-library-v0.1.202205021257","dom-v0.1.202205021257","design-system-v0.1.202205021257","date-v0.1.202205021257","dashboard-v0.1.202205021257","animation-v0.1.202205021257","v1.4.0","v1.2","v1.1.1","v1.1.0","v1.0.0","v1.0.0-rc.1","v1.0.0-beta.1","v1.0.0-alpha.10+780b5cf","v1.0.0-alpha.9+2ce347d","v1.0.0-alpha.8+884d7ee","v1.0.0-alpha.7+a4b8821","v1.0.0-alpha.6+800825c","v1.0.0-alpha.5+7ddc322","v1.0.0-alpha.4+795ce38","v1.0.0-alpha.3+30921a4","v1.0.0-alpha.2+9290589","v1.0.0-alpha.1+23e6783"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1979.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}]}