CVE-2023-6741

WP Customer Area < 8.2.1 - Subscriber+ Account Address Update

CVSS 4.3 MEDIUMEPSS 0.4%

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

16 jan 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Produtos afetados

Unknown · WP Customer Area

Referências

https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a/