CVE-2023-6373 is a high severity SQL injection in the ArtPlacer Widget plugin for WordPress. The id parameter is not sanitised or escaped before it reaches a database query. The record says versions before 2.20.7 are affected, so update to 2.20.7 or later, or remove the plugin.
What's affected
- Product: ArtPlacer Widget, a WordPress plugin.
- Affected: versions before 2.20.7, per the record.
- Fixed: 2.20.7.
- Who can trigger it: editors and above. The record adds that a missing CSRF check means an attack could also be driven through a logged in editor or higher.
The record gives a CVSS 3.1 base score of 8.8 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Check the plugin version on every WordPress site you run.
- Update ArtPlacer Widget to 2.20.7 or later. If the plugin is not in active use, delete it rather than leaving it installed.
- Review which accounts hold the editor role or higher and remove any that are unneeded.
- Ask editors not to browse untrusted sites in the same browser session while logged in until the update is applied.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-89 (SQL Injection): User controlled values are placed into a database query without proper escaping or parameter binding, so the query text itself can be changed.
Injection happens when a value from a request becomes part of a database query without being bound as a parameter. Here the value is the id parameter. If the query text can be changed, the database can be made to return or alter data that the page was never meant to expose.
The privilege bar is not zero. An editor account is required, which lowers the risk compared with an anonymous flaw. The missing CSRF check changes that picture a little, because a logged in editor visiting a hostile page could be the carrier. That is why the update matters even on sites with trusted editors.
Quick check
Do I need to be an editor to be at risk?
The attacker needs editor access or must trick a logged in editor into sending a request. Both routes are described in the record.
What is the fixed version?
The record says before 2.20.7 is affected, so 2.20.7 is the first fixed release named.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
