What’s Vulnerable › Vulnerabilities

CVE-2023-6066: WP Custom Widget Area <= 1.2.5 - Subscriber+ Menus Creation/Deletion/Update

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-01-15 · updated 2026-06-17
• Weakness: CWE-862

Description

The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.

Affected products

• WP Custom Widget area: through 1.2.5

References

• https://wpscan.com/vulnerability/f8f84d47-49aa-4258-a8a6-3de8e7342623
• https://wpscan.com/vulnerability/f8f84d47-49aa-4258-a8a6-3de8e7342623

Get alerted when CVE-2023-6066 or the next vulnerability affects your stack