CVE-2023-0820
User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF
- State
- Published
- Severity
- 8.8 High
- Published
- Apr 3, 2023
- Updated
- Feb 14, 2025
- Reserved
- Feb 13, 2023
Description
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
User Role by BestWebSoftUnknown |
|
References
- https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.