CVE-2023-0385

The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrect nonce validation on the custom_404_pro_admin_init function. This makes it possible for unauthenticated attackers to delete logs, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/custom-404-pro/tags/3.7.1/admin/AdminClass.php#L114Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/968920b9-febf-4d76-a16b-f27954cd72e5?source=cve
• https://plugins.trac.wordpress.org/browser/custom-404-pro/tags/3.7.1/admin/AdminClass.php#L114Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/968920b9-febf-4d76-a16b-f27954cd72e5Patch, Third Party Advisory

Published

Jan 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-0379The Spotlight Social Feeds WordPress plugin before 1.4.3 doe…5.4
• CVE-2023-0380The Easy Digital Downloads WordPress plugin before 3.1.0.5 d…5.4
• CVE-2023-0381The GigPress WordPress plugin through 2.3.28 does not valida…8.8
• CVE-2023-0382User-controlled operations could have allowed Denial of Serv…6.5
• CVE-2023-0383User-controlled operations could have allowed Denial of Serv…7.5
• CVE-2023-0384User-controlled operations could have allowed Denial of Serv…7.5
• CVE-2023-0386A flaw was found in the Linux kernel, where unauthorized acc…7.8
• CVE-2023-0387Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-0388The Random Text WordPress plugin through 0.3.0 does not prop…8.8
• CVE-2023-0389The Calculated Fields Form WordPress plugin before 1.1.151 d…4.8
• CVE-2023-0391MGT-COMMERCE CloudPanel ships with a static SSL certificate …8.1
• CVE-2023-0392The LDAP Agent Update service with versions prior to 5.18 us…6.7