CVE-2023-4276 HIGH

CVE-2023-4276: Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change

Vendor Johnkolbert
Product Absolute Privacy
Weakness CWE-352 · CSRF
Published August 10, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abpr_profileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Key dates

02Disclosure timeline

August 10, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-10499 Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update CVE-2025-23985 WordPress Dynamic URL SEO plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2025-22343 WordPress wpSOL plugin <= 1.2.0 - CSRF to Stored XSS vulnerability CVE-2025-46458 WordPress occupancyplan plugin <= 1.0.3.0 - CSRF to SQL Injection vulnerability CVE-2025-46528 WordPress Availability Calendar plugin <= 0.2.4 - Cross Site Request Forgery (CSRF) Vulnerability