CVE-2023-0453
Last modified
CVE-2023-0453 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apusthemes | Wp Private Messaging | < 1.0.6 |
References
- https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-aec1-c3be11e2a6deExploit, Third Party Advisory
- https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-aec1-c3be11e2a6deExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-0453?
How severe is CVE-2023-0453?
How do I fix CVE-2023-0453?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-0447The My YouTube Channel plugin for WordPress is vulnerable to…4.3
- CVE-2023-0448The WP Helper Lite WordPress plugin, in versions < 4.3, retu…6.1
- CVE-2023-0449Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2023-0450An issue has been discovered in GitLab affecting all version…4.6
- CVE-2023-0451Econolite EOS versions prior to 3.2.23 lack a password requi…7.5
- CVE-2023-0452Econolite EOS versions prior to 3.2.23 use a weak hash algor…5.3
- CVE-2023-0454OrangeScrum version 2.0.11 allows an authenticated external …8.1
- CVE-2023-0455Unrestricted Upload of File with Dangerous Type in GitHub re…8.8
- CVE-2023-0456A flaw was found in APICast, when 3Scale's OIDC module does …7.5
- CVE-2023-0457Plaintext Storage of a Password vulnerability in Mitsubishi …7.5
- CVE-2023-0458A speculative pointer dereference problem exists in the Linu…4.7
- CVE-2023-0459Copy_from_user on 64-bit versions of the Linux kernel does n…5.5
Are you affected by CVE-2023-0453?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST