CVE-2023-6384

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Unknown	WP User Profile Avatar	< 1.0.1

References

https://wpscan.com/vulnerability/fbdefab4-614b-493b-a9ae-c5aeff8323ef/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/fbdefab4-614b-493b-a9ae-c5aeff8323ef/Exploit, Third Party Advisory

Timeline

Published: Jan 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-63854.3The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to ma CVE-2023-63867.5A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 an CVE-2023-63877.5A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service o CVE-2023-63885.0Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is v CVE-2023-63896.1The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthentic CVE-2023-63908.8The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers t CVE-2023-63918.8The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers t CVE-2023-63935.3A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses th CVE-2023-63949.1A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQ CVE-2023-63959.8The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arb CVE-2023-63975.3A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware v CVE-2023-63987.2A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37