CVE-2023-0498

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	WP Education	< 1.2.7

References

https://wpscan.com/vulnerability/8fa051ad-5b35-46d8-be95-0ac4e73d5effExploit, Third Party Advisory
https://wpscan.com/vulnerability/8fa051ad-5b35-46d8-be95-0ac4e73d5effExploit, Third Party Advisory

Timeline

Published: Mar 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04994.3The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in CVE-2023-05006.5The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logge CVE-2023-05016.5The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged CVE-2023-05026.5The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in a CVE-2023-05034.3The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow CVE-2023-05044.3The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in CVE-2023-05054.3The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged CVE-2023-05068.8The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, dete CVE-2023-05075.4Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability CVE-2023-05084.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 befo CVE-2023-05097.4Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.CVE-2023-05119.8Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Acce