CVE-2023-6741

WP Customer Area < 8.2.1 - Subscriber+ Account Address Update

CVSS 4.3 MEDIUMEPSS 0.4%

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 4.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

16 ene 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Productos afectados

Unknown · WP Customer Area

Referencias

https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a/