CVE-2023-6741

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-67424.3The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to an imCVE-2023-67438.8The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all veCVE-2023-67445.4The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'et_pb_text' shortcode in all versions up to, andCVE-2023-67455.4The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versionsCVE-2023-67465.7An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end seCVE-2023-67475.4The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom attributes iCVE-2023-67484.3The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 vCVE-2023-67499.8Unchecked length coming from user input in settings shellCVE-2023-67507.5The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessibleCVE-2023-67516.5The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function puCVE-2023-67538.8Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.CVE-2023-67557.2A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/conte