CVE-2023-0453

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Feb 21, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-04548.1OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible becauCVE-2023-04558.8Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.CVE-2023-04567.5A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. CVE-2023-04577.5Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series andCVE-2023-04584.7A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlledCVE-2023-04595.5Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_okCVE-2023-04607.3The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags ConteCVE-2023-04617.8There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulneCVE-2023-04629.1An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operatCVE-2023-04633.3The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022CVE-2023-04647.5A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains tCVE-2023-04655.3Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent cert
CVE-2023-0453: Medium severity, CVSS 4.3 | Vulnix