CVEvulnerability

CVE-2023-6066

4.3 MEDIUM Published 2024-01-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-01-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862

Description

The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.

Affected configurations

• kishorkhambu wp custom widget area (<= 1.2.5)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References