blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-0453

MEDIUM 4.3 CVSS 3.1
Published
February 21, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.

Affected products and versions

  • Unknown WP Private Message — Before 1.0.6
  • apusthemes wp_private_messaging — Before 1.0.6

References

  • themeforest.net https://themeforest.net/item/superio-job-board-wordpress-theme/32180231 Product
  • wpscan.com https://wpscan.com/vulnerability/f915e5ac-e216-4d1c-aec1-c3be11e2a6de Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record