What’s Vulnerable › Vulnerabilities

CVE-2023-0820: User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-03 · updated 2026-06-17
• Weakness: CWE-352

Description

The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.

Affected products

• BestWebSoft User Role: before 1.6.7 — fixed in 1.6.7

How to fix

Upgrade to a fixed version: BestWebSoft User Role 1.6.7. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912
• https://wpscan.com/vulnerability/b93d9f9d-0fd9-49b8-b465-d32b95351912

Get alerted when CVE-2023-0820 or the next vulnerability affects your stack