CVE-2023-1088

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected software

Vendor	Product	Versions
Unknown	WP Plugin Manager	< 1.1.8

References

https://wpscan.com/vulnerability/a956f1cd-fce4-4235-b1af-4b7675a60ca2Exploit, Third Party Advisory
https://wpscan.com/vulnerability/a956f1cd-fce4-4235-b1af-4b7675a60ca2Exploit, Third Party Advisory

Timeline

Published: Mar 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-10894.3The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in CVE-2023-10904.8The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege use CVE-2023-10919.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpata Licensed Warehousing Automation CVE-2023-10926.5The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sig CVE-2023-10936.5The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allo CVE-2023-10948.8MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food`CVE-2023-10955.5In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_des CVE-2023-10969.8SnapCenter versions 4.7 prior to 4.7P2 and 4.8 prior to 4.8P1 are susceptible to a vulnerability which could allow a remote unauthenticated CVE-2023-10979.8Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injection CVE-2023-10984.9An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all ver CVE-2023-10999.8A vulnerability was found in SourceCodester Online Student Management System 1.0. It has been rated as critical. Affected by this issue is s CVE-2023-11009.8A vulnerability classified as critical has been found in SourceCodester Online Catering Reservation System 1.0. This affects an unknown part