CVE-2023-6824

MEDIUM

WP Customer Area < 8.2.1 - Unauthenticated User Data Exposure via AJAX Action Capability Bypass

Title source: llm

Description

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.

References (1)

Core 1

Core References

Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/a224b984-770a-4534-b689-0701b582b388/

Scores

CVSS v3 6.5

EPSS 0.0048

EPSS Percentile 37.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (1)

marvinlabs/wp_customer_area < 8.2.1

Published Jan 16, 2024

Tracked Since Feb 18, 2026