CVE-2023-0453

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Unknown	WP Private Message	< 1.0.6

References

https://themeforest.net/item/superio-job-board-wordpress-theme/32180231Product
https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-aec1-c3be11e2a6deExploit, Third Party Advisory
https://themeforest.net/item/superio-job-board-wordpress-theme/32180231Product
https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-aec1-c3be11e2a6deExploit, Third Party Advisory

Timeline

Published: Feb 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04548.1OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible becau CVE-2023-04558.8Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.CVE-2023-04567.5A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. CVE-2023-04577.5Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and CVE-2023-04584.7A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled CVE-2023-04595.5Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok CVE-2023-04607.3The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Conte CVE-2023-04617.8There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulne CVE-2023-04629.1An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operat CVE-2023-04633.3The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022 CVE-2023-04647.5A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains t CVE-2023-04655.3Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent cert