How severe is CVE-2023-1624?

CVE-2023-1624 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2023-1624 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-1624?

CVE-2023-1624 affects Wpcode. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-1624?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-1624 published?

CVE-2023-1624 was published on 2023-04-24 and last updated on 2026-06-17.

CVE-2023-1624

CVE-2023-1624 is a medium-severity vulnerability in Wpcode with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Wpcode
Published: 2023-04-24
Last modified: 2026-06-17

Description

The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders

Frequently asked questions

What is CVE-2023-1624?: The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders
How severe is CVE-2023-1624?: CVE-2023-1624 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2023-1624 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-1624?: CVE-2023-1624 affects Wpcode. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-1624?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-1624 published?: CVE-2023-1624 was published on 2023-04-24 and last updated on 2026-06-17.

References

https://wpscan.com/vulnerability/132b70e5-4368-43b4-81f6-2d01bc09dc8f

Affected products (1)

cpe:2.3:a:wpcode:wpcode:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Wpcode

CVE-2023-3524 — Medium (CVSS 6.1): The WPCode WordPress plugin before 2.0.13.1 does not escape generated URLs before outputting them in attributes,…
CVE-2023-0328 — Medium (CVSS 4.3): The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions,…

All CVEs affecting Wpcode →