{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-40600/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-40600/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-40600/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-40600/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-40600/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-40600"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-40600"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2023/CVE-2023-40600.yaml",
    "nuclei_template_severity": "medium",
    "nuclei_template_yaml": "id: CVE-2023-40600\n\ninfo:\n  name: EWWW Image Optimizer <= 7.2.0 - Unauthenticated Information Disclosure\n  author: Shivam Kamboj\n  severity: medium\n  description: |\n    The EWWW Image Optimizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.0 via the debug_log function. This makes it possible for unauthenticated attackers to extract sensitive debug data when debug logging is enabled.\n  impact:\n    Attackers can access sensitive embedded data, potentially leading to information disclosure and further exploitation.\n  remediation:\n    Remove debug information and update to the latest version of EWWW Image Optimizer.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-40600\n    - https://patchstack.com/database/wordpress/plugin/ewww-image-optimizer/vulnerability/wordpress-ewww-image-optimizer-plugin-7-2-0-sensitive-data-exposure-vulnerability\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ewww-image-optimizer/ewww-image-optimizer-720-unauthenticated-sensitive-information-exposure-via-debug-log\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2023,wp,wordpress,wp-plugin,ewww-image-optimizer,vkev\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/wp-content/ewww/debug.log\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"ewww_image_optimizer\",\"__construct()\")'\n        condition: and\n# digest: 4a0a00473045022100f081fe88954782b22420244733720ec76bcc72f13270afb18b397dee6a651107022044105d9849b1cc36e727f665e911f62b0cb62e96c74e400c24eee8518e28f89e:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2023-40600"
}