Medium severity6.3NVD Advisory· Published Nov 22, 2023· Updated Apr 8, 2026

CVE-2023-6008

Description

The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete user meta and plugin options.

Affected products

Userproplugin/Userpro
cpe:2.3:a:userproplugin:userpro:*:*:*:*:*:wordpress:*:*
Range: <=5.1.1
WordPress/Userprollm-fuzzy
Range: <=5.1.1
Package: https://wordpress.org/plugins/userpro

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/ed6e2b9e-3d70-4c07-a779-45164816b89cnvdThird Party Advisory
codecanyon.net/item/userpro-user-profiles-with-social-login/5958681nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000