CVE-2023-6008

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.

• CWE-352
• CWE-352

• https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6e2b9e-3d70-4c07-a779-45164816b89c?source=cveThird Party Advisory
• https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ed6e2b9e-3d70-4c07-a779-45164816b89c?source=cveThird Party Advisory

Published

Nov 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6001Prometheus metrics are available without authentication. The…7.5
• CVE-2023-6002YugabyteDB is vulnerable to cross site scripting (XSS) via l…6.1
• CVE-2023-6004A flaw was found in libssh. By utilizing the ProxyCommand or…4.8
• CVE-2023-6005The EventON WordPress plugin before 4.5.5, EventON WordPress…4.8
• CVE-2023-6006This vulnerability potentially allows local attackers to esc…6.7
• CVE-2023-6007The UserPro plugin for WordPress is vulnerable to unauthoriz…6.5
• CVE-2023-6009The UserPro plugin for WordPress is vulnerable to privilege …8.8
• CVE-2023-6010Rejected reason: Accidental Request.
• CVE-2023-6011Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-6012An improper input validation vulnerability has been found in…9.8
• CVE-2023-6013H2O is vulnerable to stored XSS vulnerability which can lead…5.4
• CVE-2023-6014An attacker is able to arbitrarily create an account in MLfl…9.8