CVE-2023-4404

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Aug 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-440406.1In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by CVE-2023-440425.4A stored cross-site scripting (XSS) vulnerability in /settings/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web sc CVE-2023-440436.1A reflected cross-site scripting (XSS) vulnerability in /install/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web CVE-2023-440447.2Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php.CVE-2023-440477.2Sourcecodester Toll Tax Management System v1 is vulnerable to SQL Injection.CVE-2023-440485.4Sourcecodester Expense Tracker App v1 is vulnerable to Cross Site Scripting (XSS) via add category.CVE-2023-44066.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Re CVE-2023-440618.8File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload fu CVE-2023-44079.8A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality CVE-2023-440755.4Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the CVE-2023-440779.8Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636.CVE-2023-44087.5The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typ