CVE-2023-51483 CRITICAL

CVE-2023-51483: WordPress WP Frontend Profile plugin <= 1.3.1 - Unauthenticated Privilege Escalation vulnerability

Vendor Glowlogix
Product WP Frontend Profile
Weakness CWE-269
Published May 17, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in Glowlogix WP Frontend Profile allows Privilege Escalation.This issue affects WP Frontend Profile: from n/a through 1.3.1.

Explanation of Vulnerability in Simple Terms

02Summary

WP Frontend Profile through version 1.3.1 contains a privilege management flaw that allows unauthenticated attackers to gain full control of the site over the network. No user interaction or special configuration is required. An attacker can read, modify, or delete any data and run their own code on the affected WordPress site.

What an attacker can do

03Attacker Capabilities

Run code on the site, read all data, modify or delete content, and take full administrative control without needing a password.

Potential impact on your site

04Site Impact

Complete compromise of the WordPress site and all its data; attacker gains admin-level access remotely.

Conditions required to exploit

05Prerequisites

Network access only; no authentication, user interaction, or special setup required.

Key dates

06Disclosure timeline

May 17, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-2375 App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter CVE-2026-8809 Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter CVE-2026-8719 AI Engine 3.4.9 - Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token CVE-2026-12736 WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint CVE-2026-6895 Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action