CVE-2023-5448 is a high severity (CVSS 8.8) cross-site request forgery flaw in the WP Register Profile With Shortcode WordPress plugin, versions up to and including 3.5.9. A forged request can reset a user's password. Update to a release newer than 3.5.9, or remove the plugin if you cannot confirm a fixed version.
What's affected
- Plugin: WP Register Profile With Shortcode for WordPress, published by aviplugins.
- Affected: all versions up to and including 3.5.9.
- Fixed version: the NVD record does not name one. CleanTalk, the researcher site, says the author released an update, but the page does not give a version number. Check the plugin changelog on WordPress.org for the first release after 3.5.9.
- Severity: 8.8 High in the NVD record (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). CleanTalk labels the same issue Critical. Both are correct for their own scoring, so treat it as serious.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under WP Register Profile With Shortcode. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for WP Register Profile With Shortcode and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. If you manage many sites, run the command through your usual fleet tooling and filter for the plugin name.
The plugin folder is usually named wp-register-profile-with-shortcode. A version of 3.5.9 or lower means the site is in the affected range.
What to do now
- Update the plugin to the newest release from the WordPress.org plugin page. Confirm in the changelog that it is later than 3.5.9.
- If no newer release is available for your site, deactivate and delete the plugin. Move registration and profile forms to another mechanism.
- Review recent password reset activity for administrator and editor accounts. Look for resets nobody asked for.
- Force a password reset for privileged accounts if you see anything odd, and invalidate their active sessions.
- Add the plugin to your inventory so the next advisory for it is caught quickly.
Why it matters
The record says the update password function does not validate a nonce correctly. A WordPress nonce is a one-time token that proves a request came from a page the site itself served. Without a working check, any web page can make a logged-in browser send the request on the victim's behalf. The attacker needs the victim to click a link or visit a page, which is why the vector shows user interaction as required.
The weakness class is CWE-352, cross-site request forgery. Password reset is a bad place for it, because a reset that succeeds on an administrator account is a full site takeover. CleanTalk says account takeover of an administrator is possible in some circumstances. The record does not list this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Does the attacker need a login?
No account is needed on the attacker side. The victim has to be tricked into a click while their browser is signed in, so the realistic target is a user with a valuable account, such as an administrator.
Is this exploited in the wild?
The record marks it as not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages checked say it is exploited. CleanTalk notes a proof of concept exists, so do not treat that as safety.
Sources
Last reviewed: 19 October 2026.
