CVE-2023-6066
WP Custom Widget Area <= 1.2.5 - Subscriber+ Menus Creation/Deletion/Update
- State
- Published
- Severity
- 4.3 Medium
- Published
- Jan 15, 2024
- Updated
- Jan 9, 2026
- Reserved
- Nov 9, 2023
Description
The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
WP Custom Widget areaUnknown |
|
References
- https://wpscan.com/vulnerability/f8f84d47-49aa-4258-a8a6-3de8e7342623exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.