CVE-2023-6741

WP Customer Area < 8.2.1 - Subscriber+ Account Address Update

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.

Affected

WP Customer Area

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.39% chance of exploitation in the next 30 days, 32nd percentile

Published

2024-01-16

Updated

2025-06-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a/

Security advisories

• https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a

References

• CVE Record
• NVD entry