PoC Index

CVE-2023-0453

MEDIUM 4.3EPSS 0.6%

The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.

CVSS v3.1
4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v3.1
4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
0.55% chance of exploitation in the next 30 days, 44th percentile
Published
2023-02-21
Updated
2025-03-12

Proof-of-concept exploits (1)

References

Related