CVE-2023-6741

EUVD-2023-58954
The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CISA-ADPADP
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
marvinlabswp_customer_area
𝑥
< 8.2.1
𝑥
= Vulnerable software versions
References
https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a/
https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a/