CVE-2023-2556

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcs_sd_delete action in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete an arbitrary custom drop-down currency switcher.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-255609.8DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials,CVE-2023-255619.8DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authenticat CVE-2023-255629.8DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events a CVE-2023-255637.5GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds CVE-2023-255648.2GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can b CVE-2023-255657.5GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when CVE-2023-255667.5GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be tr CVE-2023-255677.5GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target in CVE-2023-255687.5Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an atta CVE-2023-255695.7Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticate CVE-2023-25574.3The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing CVE-2023-255707.5Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservic