CVE-2023-1509

The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing nonce validation on the gmace_manager_server function called via the wp_ajax_gmace_manager AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/gmace/trunk/gmace.php?rev=1583327#L84Product
• https://plugins.trac.wordpress.org/browser/gmace/trunk/inc/filemanager.php?rev=1583319#L27Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/826b3913-9a37-4e15-80fd-b35cefb51af8?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/gmace/trunk/gmace.php?rev=1583327#L84Product
• https://plugins.trac.wordpress.org/browser/gmace/trunk/inc/filemanager.php?rev=1583319#L27Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/826b3913-9a37-4e15-80fd-b35cefb51af8?source=cveThird Party Advisory

Published

Mar 29, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1503A vulnerability classified as critical has been found in Sou…8.1
• CVE-2023-1504A vulnerability classified as critical was found in SourceCo…8.1
• CVE-2023-1505A vulnerability, which was classified as critical, has been …8.1
• CVE-2023-1506A vulnerability, which was classified as critical, was found…8.1
• CVE-2023-1507A vulnerability has been found in SourceCodester E-Commerce …6.1
• CVE-2023-1508Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-1513A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS …3.3
• CVE-2023-1514A vulnerability exists in the component RTU500 Scripting int…7.5
• CVE-2023-1515Cross-site Scripting (XSS) - Stored in GitHub repository pim…5.4
• CVE-2023-1516RoboDK versions 5.5.3 and prior contain an insecure permissi…7.8
• CVE-2023-1517Cross-site Scripting (XSS) - DOM in GitHub repository pimcor…4.8
• CVE-2023-1518CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vuln…7.5