CVE-2023-3052

The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_add_post', 'azh_duplicate_post', 'azh_update_post' and 'azh_remove_post' functions. This makes it possible for unauthenticated attackers to create, modify, and delete a post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4085Patch
• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4137Patch
• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4159Patch
• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4174Patch
• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4190Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e26035-ce4e-4b4b-aa3c-cd86b29b199a?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4085Patch
• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4137Patch
• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4159Patch
• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4174Patch
• https://plugins.trac.wordpress.org/browser/page-builder-by-azexo/trunk/azexo_html.php#L4190Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a4e26035-ce4e-4b4b-aa3c-cd86b29b199a?source=cveThird Party Advisory

Published

Jun 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30514Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earli…7.5
• CVE-2023-30515Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earli…7.5
• CVE-2023-30516Jenkins Image Tag Parameter Plugin 2.0 improperly introduces…6.5
• CVE-2023-30517Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earl…5.3
• CVE-2023-30518A missing permission check in Jenkins Thycotic Secret Server…4.3
• CVE-2023-30519A missing permission check in Jenkins Quay.io trigger Plugin…5.3
• CVE-2023-30520Jenkins Quay.io trigger Plugin 0.1 and earlier does not limi…5.4
• CVE-2023-30521A missing permission check in Jenkins Assembla merge request…5.3
• CVE-2023-30522A missing permission check in Jenkins Fogbugz Plugin 2.2.17 …4.3
• CVE-2023-30523Jenkins Report Portal Plugin 0.5 and earlier stores ReportPo…4.3
• CVE-2023-30524Jenkins Report Portal Plugin 0.5 and earlier does not mask R…4.3
• CVE-2023-30525A cross-site request forgery (CSRF) vulnerability in Jenkins…8.8