CVE-2023-6066

Published: Jan 15, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.

Affected (1)

Products: Kishorkhambu: Wp Custom Widget Area

1 product

Wp Custom Widget Area

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Kishorkhambu Wp Custom Widget Area	Up to 1.2.5

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://wpscan.com/vulnerability/f8f84d47-49aa-4258-a8a6-3de8e7342623

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/f8f84d47-49aa-4258-a8a6-3de8e7342623

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.