CVE-2023-27633 MEDIUM

CVE-2023-27633: WordPress Customify Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Pixelgrade
Product Customify – Intuitive Website Styling
Weakness CWE-352 · CSRF
Published November 22, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Customify versions up to 2.10.4 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, triggers unintended changes to site settings. The vulnerability requires no special privileges but does require the admin to click a link or visit a page controlled by the attacker.

What an attacker can do

03Attacker Capabilities

Trick an admin into making unwanted changes to site styling or settings via a malicious link.

Potential impact on your site

04Site Impact

Site admins could unknowingly alter Customify settings, potentially affecting site appearance or functionality.

Conditions required to exploit

05Prerequisites

Admin must visit a malicious page or click an attacker-controlled link while logged in.

Key dates

06Disclosure timeline

November 22, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65471 WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-57758 WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability CVE-2026-4275 Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint CVE-2026-63265 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints CVE-2026-65488 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability