CVE-2023-36690 - Vulnerability Details - OpenCVE

Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00072.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Vibethemes	Wordpress Learning Management System

Configuration 1 [-]

cpe:2.3:a:vibethemes:wordpress_learning_management_system:*:*:*:*:*:wordpress:*:*

No data.

No data.

References

Link	Providers
https://patchstack.com/database/vulnerability/wplms/wordpress-wplms-theme-4-600-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

History

Mon, 15 Dec 2025 13:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Vibethemes wordpress Learning Management System
CPEs	cpe:2.3:a:vibethemes:wordpress_learning_management_system_::::::wordpress::*	cpe:2.3:a:vibethemes:wordpress_learning_management_system::::::wordpress::*
Vendors & Products	Vibethemes wordpress Learning Management System	Vibethemes wordpress Learning Management System

Mon, 07 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2023-07-11T12:01:02.045Z

Updated: 2024-10-07T17:31:56.910Z

Reserved: 2023-06-26T12:05:50.939Z

Link: CVE-2023-36690

Vulnrichment

Updated: 2024-08-02T16:52:54.079Z

NVD

Status : Analyzed

Published: 2023-07-11T13:15:10.173

Modified: 2025-12-15T13:00:53.837

Link: CVE-2023-36690

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-36690", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2023-06-26T12:05:50.939Z", "datePublished": "2023-07-11T12:01:02.045Z", "dateUpdated": "2024-10-07T17:31:56.910Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://themeforest.net/", "defaultStatus": "unaffected", "packageName": "wplms", "product": "WPLMS", "vendor": "VibeThemes", "versions": [{"changes": [{"at": "4.900", "status": "unaffected"}], "lessThan": "4.900", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Dave Jong (Patchstack)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <=<span style=\"background-color: var(--wht);\"> 4.900 versions.</span>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <=\u00a04.900 versions."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2023-07-11T12:01:02.045Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/vulnerability/wplms/wordpress-wplms-theme-4-600-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to 4.900 or a higher version."}], "value": "Update to\u00a04.900 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress WPLMS Theme < 4.900 is vulnerable to Cross Site Request Forgery (CSRF)", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:52:54.079Z"}, "title": "CVE Program Container", "references": [{"tags": ["vdb-entry", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/wplms/wordpress-wplms-theme-4-600-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-07T17:31:46.738753Z", "id": "CVE-2023-36690", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:31:56.910Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://patchstack.com/database/vulnerability/wplms/wordpress-wplms-theme-4-600-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "tags": ["vdb-entry", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:52:54.079Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-36690", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-07T17:31:46.738753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:31:52.328Z"}}], "cna": {"title": "WordPress WPLMS Theme < 4.900 is vulnerable to Cross Site Request Forgery (CSRF)", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Dave Jong (Patchstack)"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VibeThemes", "product": "WPLMS", "versions": [{"status": "affected", "changes": [{"at": "4.900", "status": "unaffected"}], "version": "n/a", "lessThan": "4.900", "versionType": "custom"}], "packageName": "wplms", "collectionURL": "https://themeforest.net/", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to\u00a04.900 or a higher version.", "supportingMedia": [{"type": "text/html", "value": "Update to 4.900 or a higher version.", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/vulnerability/wplms/wordpress-wplms-theme-4-600-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <=\u00a04.900 versions.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <=<span style=\"background-color: var(--wht);\"> 4.900 versions.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2023-07-11T12:01:02.045Z"}}}, "cveMetadata": {"cveId": "CVE-2023-36690", "state": "PUBLISHED", "dateUpdated": "2024-10-07T17:31:56.910Z", "dateReserved": "2023-06-26T12:05:50.939Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2023-07-11T12:01:02.045Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}