CVE-2023-6197

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the audio_merchant_save_settings function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Audio Merchant	Audio Merchant	<= 5.0.4

References

https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L951Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/d7911337-57fa-4268-8366-d37ff13fae86?source=cveThird Party Advisory
https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L951Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/d7911337-57fa-4268-8366-d37ff13fae86?source=cveThird Party Advisory

Timeline

Published: Nov 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-61989.3Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access CVE-2023-61996.5Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.CVE-2023-62007.5A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an CVE-2023-62018.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Computer System Panorama CVE-2023-62024.3Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user a CVE-2023-62037.5The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted CVE-2023-62046.5On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the CVE-2023-62056.5It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash.CVE-2023-62065.4The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible CVE-2023-62078.8Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and CVE-2023-62088.8When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not CVE-2023-62096.5Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override th