CVE-2023-6748

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the 'cft' shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862CWE-922

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-67499.8Unchecked length coming from user input in settings shellCVE-2023-67507.5The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessibleCVE-2023-67516.5The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function puCVE-2023-67538.8Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.CVE-2023-67557.2A vulnerability was found in DedeBIZ 6.2 and classified as critical. This issue affects some unknown processing of the file /src/admin/conteCVE-2023-67569.8A vulnerability was found in Thecosy IceCMS 2.0.1. It has been classified as problematic. Affected is an unknown function of the file /loginCVE-2023-67576.5A vulnerability was found in Thecosy IceCMS 2.0.1. It has been declared as problematic. Affected by this vulnerability is an unknown functioCVE-2023-67584.3A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of thCVE-2023-67597.5A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/resoCVE-2023-67605.4A vulnerability classified as critical was found in Thecosy IceCMS up to 2.0.1. This vulnerability affects unknown code. The manipulation leCVE-2023-67618.8A vulnerability, which was classified as problematic, has been found in Thecosy IceCMS up to 2.0.1. This issue affects some unknown processiCVE-2023-67624.3A vulnerability, which was classified as critical, was found in Thecosy IceCMS 2.0.1. Affected is an unknown function of the file /article/D
CVE-2023-6748: Medium severity, CVSS 4.3 | Vulnix