CVE-2023-5537

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing nonce validation on the delumet_options_page() function. This makes it possible for unauthenticated attackers to remove user meta for arbitrary users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Nov 22, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-55386.1The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and inclCVE-2023-55398.8A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.CVE-2023-55408.8A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.CVE-2023-55416.1The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.CVE-2023-55424.3Students in "Only see own membership" groups could see other students in the group, which should be hidden.CVE-2023-55433.3When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This CVE-2023-55445.4Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.CVE-2023-55455.3H5P metadata automatically populated the author with the user's username, which could be sensitive information.CVE-2023-55465.4ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.CVE-2023-55476.1The course upload preview contained an XSS risk for users uploading unsafe data.CVE-2023-55485.3Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.CVE-2023-55495.3Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they di
CVE-2023-5537: Medium severity, CVSS 4.3 | Vulnix