CVE-2023-7074

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WP SOCIAL BOOKMARK MENU WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	WP SOCIAL BOOKMARK MENU	<= 1.2

References

https://magos-securitas.com/txt/CVE-2023-7074.txtExploit
https://wpscan.com/vulnerability/7906c349-97b0-4d82-aef0-97a1175ae88e/Exploit, Third Party Advisory
https://magos-securitas.com/txt/CVE-2023-7074.txtExploit
https://wpscan.com/vulnerability/7906c349-97b0-4d82-aef0-97a1175ae88e/Exploit, Third Party Advisory

Timeline

Published: Jan 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-70756.1A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by thi CVE-2023-70766.1A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of th CVE-2023-70779.8Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554 CVE-2023-70788.1Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the serv CVE-2023-70795.7Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer bein CVE-2023-70808.0The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start CVE-2023-70819.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows CVE-2023-70827.2The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicl CVE-2023-70835.4The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi CVE-2023-70845.4The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such CVE-2023-70855.4The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as CVE-2023-70865.4The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as A