CVE-2023-4307

Name of the Vulnerable Software and Affected Versions Lock User Account WordPress plugin versions 1.0.3 and earlier

Description The issue concerns a lack of CSRF check in the Lock User Account WordPress plugin when performing bulk locking and unlocking of accounts. This could allow attackers to make logged-in admins lock and unlock arbitrary users via a CSRF attack.

Recommendations For Lock User Account WordPress plugin versions 1.0.3 and earlier, update to a version that includes a CSRF check for bulk locking and unlocking accounts to prevent exploitation. As a temporary workaround, consider restricting access to the bulk account management feature until a patch is available.