CVE-2023-4059
Last modified
CVE-2023-4059 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cozmoslabs | Profile Builder | < 3.9.8 |
References
- https://wpscan.com/vulnerability/fc719d12-2f58-4d1f-b696-0f937e706842Third Party Advisory
- https://wpscan.com/vulnerability/fc719d12-2f58-4d1f-b696-0f937e706842Third Party Advisory
- https://wpscan.com/vulnerability/fc719d12-2f58-4d1f-b696-0f937e706842Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-4059?
How severe is CVE-2023-4059?
How do I fix CVE-2023-4059?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-40584Argo CD is a declarative continuous deployment for Kubernete…6.5
- CVE-2023-40585ironic-image is a container image to run OpenStack Ironic as…7.5
- CVE-2023-40586OWASP Coraza WAF is a golang modsecurity compatible web appl…7.5
- CVE-2023-40587Pyramid is an open source Python web framework. A path trave…5.3
- CVE-2023-40588Discourse is an open-source discussion platform. Prior to ve…6.5
- CVE-2023-40589FreeRDP is a free implementation of the Remote Desktop Proto…7.5
- CVE-2023-40590 GitPython is a python library used to interact with Git rep…7.8
- CVE-2023-40591go-ethereum (geth) is a golang execution layer implementatio…7.5
- CVE-2023-40592In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12…6.1
- CVE-2023-40593In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a…7.5
- CVE-2023-40594In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and …7.5
- CVE-2023-40595In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and …8.8
Are you affected by CVE-2023-4059?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST