CVE-2023-6390

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	WordPress Users	<= 1.4

References

https://magos-securitas.com/txt/2023-6390.txtBroken Link
https://wpscan.com/vulnerability/a0ca68d3-f885-46c9-9f6b-b77ad387d25d/Exploit, Third Party Advisory
https://magos-securitas.com/txt/2023-6390.txtBroken Link
https://wpscan.com/vulnerability/a0ca68d3-f885-46c9-9f6b-b77ad387d25d/Exploit, Third Party Advisory

Timeline

Published: Jan 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-63918.8The Custom User CSS WordPress plugin through 0.2 does not have CSRF check in place when updating its settings, which could allow attackers t CVE-2023-63935.3A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses th CVE-2023-63949.1A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQ CVE-2023-63959.8The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arb CVE-2023-63975.3A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX series firmware v CVE-2023-63987.2A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 CVE-2023-63996.5A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4 CVE-2023-64007.4Incorrect Authorization vulnerability in OpenText™ ZENworks Configuration Management (ZCM) allows Unauthorized Use of Device Resources.This CVE-2023-64017.8A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of th CVE-2023-64028.8A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknow CVE-2023-64077.1A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary fil CVE-2023-64088.1CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a de