CVE-2023-4307
Lock User Account <= 1.0.3 - Arbitrary Account Lock/Unlock via CSRF
MEDIUM 4.3EPSS 0.3%
The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack
- Affected
- Lock User Account
- CVSS v3.1 NVD
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - EPSS
- 0.25% chance of exploitation in the next 30 days, 16th percentile
- Published
- 2023-09-11
- Updated
- 2025-04-23