CVE-2023-4213

The Simplr Registration Form Plus+ plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.4.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with subscriber-level permissions or above to change user passwords and potentially take over administrator accounts.

• CWE-639
• CWE-639

• https://plugins.trac.wordpress.org/browser/simplr-registration-form/trunk/lib/profile.php#L148Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6ddf0452-3afe-4ada-bccc-30c818968a81?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/simplr-registration-form/trunk/lib/profile.php#L148Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6ddf0452-3afe-4ada-bccc-30c818968a81?source=cveThird Party Advisory

Published

Sep 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42124Avast Premium Security Sandbox Protection Incorrect Authoriz…7.8
• CVE-2023-42125Avast Premium Security Sandbox Protection Link Following Pri…7.8
• CVE-2023-42126G DATA Total Security GDBackupSvc Service Link Following Loc…7.8
• CVE-2023-42127Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote …7.8
• CVE-2023-42128Magnet Forensics AXIOM Command Injection Remote Code Executi…8
• CVE-2023-42129A10 Thunder ADC ShowTechDownloadView Directory Traversal Inf…6.5
• CVE-2023-42130A10 Thunder ADC FileMgmtExport Directory Traversal Arbitrary…8.8
• CVE-2023-42131Ansys SpaceClaim X_B File Parsing Out-Of-Bounds Write Remote…7.8
• CVE-2023-42132FD Application Apr. 2022 Edition (Version 9.01) and earlier …5.5
• CVE-2023-42133PAX Android based POS devices allow for escalation of privil…6.7
• CVE-2023-42134PAX Android based POS devices with PayDroid_8.1.0_Sagittariu…6.8
• CVE-2023-42135PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.…6.8