6.5
Medium
CVE-2023-1623 The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug…
Description
The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Custom Post Type UI 1.13 | earliest → < 1.13.5 | 1.13.5 |