CVE-2023-2448

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to arbitrary shortcode execution. An attacker can leverage CVE-2023-2446 to get sensitive information via shortcode.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Nov 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-244807.5Controller DoS due to stack overflow when decoding a message from the server.  See Honeywell Security Notification for recommendations on uCVE-2023-244816.3Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentCVE-2023-244829.8A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versiCVE-2023-244837.8A vulnerability has been identified that, if exploited, could result in a local user elevating their privilege level to NT AUTHORITY\SYSTEM CVE-2023-244845.5A malicious user can cause log files to be written to a directory that they do not have permission to write to.CVE-2023-244857.8Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer runniCVE-2023-244865.5A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able toCVE-2023-244877.5Arbitrary file read in Citrix ADC and Citrix GatewayCVE-2023-244886.1Cross site scripting vulnerability in Citrix ADC and Citrix Gateway  in allows and attacker to perform cross site scriptingCVE-2023-244899.8A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthentCVE-2023-24499.8The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plCVE-2023-244904.3Users with only access to launch VDA applications can launch an unauthorized desktop