CVE-2023-0820 json
User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF
published 2023-04-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-12824
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
Patch / fix
- Unknown User Role by BestWebSoft 1.6.7
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- wpscan.com https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- Unknown User Role by BestWebSoft
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
- Technology feeds
References
-
wpscan.com
/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912
exploit, vdb-entry, technical-description, third-party-advisory
Sources
- CVE List CVE-2023-0820
- NVD CVE-2023-0820
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.