CVE-2023-7239

PoC —

CVSS 3.1

7.5 high

EPSS

<1%p44

Published

May 15, 2025 (May 15, 2025)

Modified

Jun 17, 2026

Description

The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.

Vendors: jeroensormani
Products: wp dashboard notes
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.