PoC Index

CVE-2023-6066

MEDIUM 4.3EPSS 0.4%

The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.

CVSS v3.1
4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v3.1
4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS
0.39% chance of exploitation in the next 30 days, 32th percentile
Published
2024-01-15
Updated
2026-01-09

Proof-of-concept exploits (1)

References

Related