Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-0940

The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.

Published

2023-03-20T16:15:12.950

Last Modified

2025-02-26T19:15:16.033

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

Weaknesses
  • Type: Primary
    CWE-863
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application metagauss profilegrid < 5.3.1 Yes
References