CVE-2023-50886 MEDIUM

CVE-2023-50886: WordPress Legal Pages plugin <= 1.3.7 - CSRF + Broken Access Control vulnerability

Vendor Wpwax

Product Legal Pages

Weakness CWE-352 · CSRF

Published March 15, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7.

Explanation of Vulnerability in Simple Terms

02Summary

Legal Pages for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 1.3.7. An attacker with low-level site access can craft a malicious request that, when visited by an authenticated administrator, modifies site settings or content without the admin's knowledge. The vulnerability requires no user interaction from the attacker but does require the admin to visit a malicious page.

What an attacker can do

03Attacker Capabilities

Modify site settings or content by tricking an authenticated admin into visiting a malicious page.

Potential impact on your site

04Site Impact

An attacker with subscriber access can alter your site's legal pages or settings without your consent by exploiting admin sessions.

Conditions required to exploit

05Prerequisites

Attacker needs low-level site access (e.g., subscriber account). Admin must visit attacker-controlled page while logged in.

Key dates

06Disclosure timeline

March 15, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-50886 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities