{"id":"CVE-2023-5509","aliases":["EUVD-2023-57823","GHSA-xvc2-6386-99x8"],"status":"published","title":"myStickymenu \u003c 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion","description":"The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0052,"percentile":0.44483,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2023-11-20T18:55:10Z","modified":"2026-06-17T06:48:44Z","products":[{"vendor":"premio","product":"mystickymenu"},{"vendor":"unknown","product":"floating notification bar, sticky menu on scroll, announcement banner, and sticky header for any theme"}],"references":[{"url":"https://wpscan.com/vulnerability/3b33c262-e7f0-4310-b26d-4727d7c25c9d","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Product","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5509"},{"url":"https://github.com/advisories/GHSA-xvc2-6386-99x8"}],"sources":{"cve":[{"id":"CVE-2023-5509","title":"myStickymenu \u003c 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion","description":"The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.","status":"published","published":"2023-11-20T18:55:10.363Z","modified":"2024-08-02T07:59:44.718Z","updated_at":"2026-11-02T14:35:16.771348Z"}],"euvd":[{"id":"EUVD-2023-57823","description":"The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.","status":"published","published":"2023-11-20T18:55:10Z","modified":"2024-08-02T07:59:44Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"none"}],"updated_at":"2026-11-03T03:50:11.629738Z"}],"ghsa":[{"id":"GHSA-xvc2-6386-99x8","title":"The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls,...","description":"The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.","status":"published","published":"2023-11-20T21:31:03Z","modified":"2023-12-06T05:05:34Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:55:09.149913Z"}],"nvd":[{"id":"CVE-2023-5509","description":"The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.","status":"published","published":"2023-11-20T19:15:09.813Z","modified":"2026-06-17T06:48:44.32Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:08:47.966245Z"}]}}