CVE-2023-0876

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	WP Meta SEO	< 4.5.3

References

https://wpscan.com/vulnerability/1a8c97f9-98fa-4e29-b7f7-bb9abe0c42eaExploit, Third Party Advisory
https://wpscan.com/vulnerability/1a8c97f9-98fa-4e29-b7f7-bb9abe0c42eaExploit, Third Party Advisory

Timeline

Published: Mar 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-08778.8Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.CVE-2023-08786.1Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1.CVE-2023-08795.4Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12.CVE-2023-08804.3Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.CVE-2023-08817.5Running DDoS on tcp port 22 will trigger a kernel crash. This issue is introduced by the backport of a commit regarding nft_lookup without t CVE-2023-08828.8Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Priv CVE-2023-08839.8A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unk CVE-2023-08877.8A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tft CVE-2023-08887.2An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90 CVE-2023-08896.5Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that t CVE-2023-08906.5The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some sho CVE-2023-08915.4The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a p