Vulnerabilities > CVE-2023-5448 - Unspecified vulnerability in Aviplugins WP Register Profile With Shortcode

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
aviplugins
NVD
Published: 2024-01-11
Updated: 2024-11-21

Summary

The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the update_password_validate function. This makes it possible for unauthenticated attackers to reset a user's password via a forged request granted they can trick the user into performing an action such as clicking on a link.

Vulnerable Configurations

Part Description Count
Application
Aviplugins
1

References