CVE-2023-51369 is a medium severity (CVSS 4.3) cross-site request forgery flaw in the Customize My Account for WooCommerce plugin, versions through 1.8.3. Patchstack says to update to version 1.8.4 or later. Exploitation needs a logged-in user to be tricked into a request, so the practical risk is low, but the fix is small.
What's affected
Patchstack's advisory lists the Customize My Account for WooCommerce WordPress plugin as affected in the range 1.8.3 and earlier. The record describes a cross-site request forgery issue in the plugin.
Patchstack gives 1.8.4 as the fixed version and says to update to 1.8.4 or later. Patchstack rates the priority low.
CVSS for this entry is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.
How to check if you're exposed
On a WordPress site with WP-CLI installed, list the plugin and its version.
wp plugin list --name=customize-my-account-for-woocommerce --fields=name,status,version,update_version
If the version is lower than 1.8.4, the site is in the affected range. You can also read the version on the Plugins page of the WordPress dashboard. For many sites, run the command on each one or use your management console.
What to do now
- Check the installed version of Customize My Account for WooCommerce on every site you run.
- Update to 1.8.4 or later from the Plugins page, or with wp plugin update customize-my-account-for-woocommerce.
- Test the site after the update, especially the features that rely on the plugin.
- If the plugin is no longer needed, deactivate and delete it rather than leaving it installed.
- Review the users on the site and remove accounts you do not recognize, since several plugin flaws depend on a low privilege account.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-352 is cross-site request forgery. A site trusts a request because it comes from a logged-in browser, without checking that the user meant to send it. The usual fix is an anti-forgery token that the server verifies on every state-changing request.
CWE-352 is cross-site request forgery. A request is trusted because it arrives from a logged-in browser, without proof that the user intended it. The NVD vector needs user interaction and shows a low availability impact only.
The score is low, but CSRF flaws are cheap to fix and to forget. Updating takes a minute, and removing unused plugins takes less attack surface with it.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
What does the attacker need?
A logged-in user must visit a page or click a link the attacker controls.
What is the fix?
Update to 1.8.4 or later.
Sources
Last reviewed: 19 October 2026.
