CVE-2023-6390 is a high severity cross-site request forgery flaw in the WordPress Users plugin for WordPress. Its settings can be changed without a CSRF check, so a logged in admin can be tricked into changing them. The record lists versions through 1.4 and names no fixed version, so check the plugin page.
What's affected
- Product: WordPress Users, a WordPress plugin.
- Affected: versions through 1.4, per the record.
- Fixed version: the record names none. Check the plugin page and the WPScan entry for a patched release, or remove the plugin.
- Who is targeted: a logged in administrator who visits a page the attacker controls.
The record gives a CVSS 3.1 base score of 8.8 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Check the plugin version on each WordPress site.
- Look at the WordPress plugin page for a release newer than 1.4. If none exists, replace the plugin or remove it.
- Review the plugin settings for values you did not set, and restore them.
- Ask administrators to use a separate browser profile for admin work and to log out when finished.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-352 (Cross-Site Request Forgery): A state changing request is accepted without confirming that the logged in user meant to send it, so another web page can trigger it through the user browser.
CSRF works because the browser attaches the admin session to every request sent to the site, including ones started by another page. If the settings handler does not require a per-request token, it cannot tell a click made on purpose from a forged one.
The high score reflects what an admin session can do. Settings pages in WordPress plugins sometimes accept values that are written back into pages or options, and the record rates confidentiality, integrity and availability impact as high. The user interaction needed is a visit to a hostile page, which is not a hard bar.
Quick check
Is there a patch?
The record does not name a fixed version. Look for a newer release on the plugin page and the WPScan entry, or remove the plugin.
Does the attacker need a login?
No login of their own. They need a logged in administrator to load their page.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
