Vulnerability · Published May 17, 2024 · Assigned by Patchstack
CVE-2023-41954WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability
High 8.6
In plain English
A high-severity privilege mismanagement in ProfilePress from ProfilePress Membership Team. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)1.4%top 27.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
Improper Privilege Management vulnerability in ProfilePress Membership Team ProfilePress allows Privilege Escalation.This issue affects ProfilePress: from n/a through 4.13.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ProfilePress Membership Team | ProfilePress | n/a – through 4.13.1 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L