What’s Vulnerable › Vulnerabilities

CVE-2023-6741: WP Customer Area < 8.2.1 - Subscriber+ Account Address Update

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-16 · updated 2026-06-17

Description

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.

Affected products

• aguilatechnologies WP Customer Area: before 8.2.1 — fixed in 8.2.1

How to fix

Upgrade to a fixed version: aguilatechnologies WP Customer Area 8.2.1. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a/
• https://wpscan.com/vulnerability/9debe1ea-18ad-44c4-8078-68eb66d36c4a/

Get alerted when CVE-2023-6741 or the next vulnerability affects your stack