CVE-2023-0820

User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF

The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.

Affected

User Role by BestWebSoft

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2023-04-03

Updated

2025-02-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912

References

• CVE Record
• NVD entry