CVE-2023-6066
WP Custom Widget Area <= 1.2.5 - Subscriber+ Menus Creation/Deletion/Update
MEDIUM 4.3EPSS 0.4%
The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.
- Affected
- WP Custom Widget area
- CVSS v3.1 NVD
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS
- 0.39% chance of exploitation in the next 30 days, 31st percentile
- Published
- 2024-01-15
- Updated
- 2026-01-09