CVE-2023-0940

HIGH · CVSS 8.8 EPSS 0.82%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2023-03-20 · Last synced 2026-08-04

CyberRota Analysis

AI analysis pending.

CVE

CVE-2023-0940

Severity

HIGH

CVSS

8.8

EPSS

0.82%

WordPress

Original NVD Description

The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.