CVE-2023-1874

The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. This is due to a lack of authorization checks on the multiple_roles_update function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wpda_role[]' parameter during a profile update. This requires the 'Enable role management' setting to be enabled for the site.

• CWE-266

• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.7/WPDataRoles/WPDA_Roles.php#L50Not Applicable
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.8/WPDataRoles/WPDA_Roles.php#L23Not Applicable
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.8/WPDataRoles/WPDA_Roles.php#L50Not Applicable
• https://www.wordfence.com/blog/2023/04/privilege-escalation-vulnerability-patched-promptly-in-wp-data-access-wordpress-plugin/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8f562e33-2aef-46f0-8a65-691155ede9e7?source=cveThird Party Advisory
• http://packetstormsecurity.com/files/171825/WordPress-WP-Data-Access-5.3.7-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.7/WPDataRoles/WPDA_Roles.php#L50Not Applicable
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.8/WPDataRoles/WPDA_Roles.php#L23Not Applicable
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.3.8/WPDataRoles/WPDA_Roles.php#L50Not Applicable
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8f562e33-2aef-46f0-8a65-691155ede9e7?source=cveThird Party Advisory

Published

Apr 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1868The YourChannel plugin for WordPress is vulnerable to unauth…5.3
• CVE-2023-1869The YourChannel plugin for WordPress is vulnerable to Store…4.8
• CVE-2023-1870The YourChannel plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2023-1871The YourChannel plugin for WordPress is vulnerable to Cross-…4.3
• CVE-2023-1872A use-after-free vulnerability in the Linux Kernel io_uring …7
• CVE-2023-1873Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-1875Cross-site Scripting (XSS) - Stored in GitHub repository tho…5.4
• CVE-2023-1876Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-1877Command Injection in GitHub repository microweber/microweber…9.8
• CVE-2023-1878Cross-site Scripting (XSS) - Stored in GitHub repository tho…5.4
• CVE-2023-1879Cross-site Scripting (XSS) - Stored in GitHub repository tho…5.4
• CVE-2023-1880Cross-site Scripting (XSS) - Reflected in GitHub repository …6.1