CVE-2023-5448

The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the update_password_validate function. This makes it possible for unauthenticated attackers to reset a user's password via a forged request granted they can trick the user into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/changeset/3018102Patch
• https://research.cleantalk.org/cve-2023-5448-wp-register-profile-with-shortcode-csrf-to-password-reset-poc/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ca564941-4780-4da2-b937-c9bd45966d81?source=cveProduct, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/3018102Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ca564941-4780-4da2-b937-c9bd45966d81?source=cveProduct, Third Party Advisory

Published

Jan 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5441NULL Pointer Dereference in GitHub repository vim/vim prior …5.5
• CVE-2023-5442Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2023-5443Improper Protection for Outbound Error Messages and Alert Si…7.5
• CVE-2023-5444 A Cross Site Request Forgery vulnerability in ePolicy Orche…8
• CVE-2023-5445 An open redirect vulnerability in ePolicy Orchestrator prio…5.4
• CVE-2023-5447Missing lock check in SynHsaService may create a use-after-f…5.5
• CVE-2023-5449A potential security vulnerability has been identified in ce…3.3
• CVE-2023-5450 An insufficient verification of data vulnerability exists i…7.8
• CVE-2023-5451Forcepoint NGFW Security Management Center Management Serve…6.1
• CVE-2023-5452Cross-site Scripting (XSS) - Stored in GitHub repository sni…5.4
• CVE-2023-5454The Templately WordPress plugin before 2.2.6 does not proper…7.5
• CVE-2023-5455A Cross-site request forgery vulnerability exists in ipa/ses…6.5