CVE-2023-0820

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	User Role by BestWebSoft	< 1.6.7

References

https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912Exploit, Third Party Advisory
https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912Exploit, Third Party Advisory

Timeline

Published: Apr 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-08216.5HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause exce CVE-2023-08228.8The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to b CVE-2023-08235.4The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes b CVE-2023-08246.5The User registration & user profile WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as we CVE-2023-08275.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.CVE-2023-08286.1Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferr CVE-2023-08299.0Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additio CVE-2023-08308.8A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipula CVE-2023-08314.3The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due CVE-2023-08324.3The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due CVE-2023-08335.5A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exceptio CVE-2023-08349.8Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issue