CVE-2023-23813

The My Calendar WordPress plugin before version 3.4.4 contains a cross-site request forgery flaw that could enable attackers to trick authenticated users with elevated privileges into performing unintended actions on the site. An attacker could exploit this vulnerability to force administrative account changes, such as password modifications, thereby gaining unauthorized access to the admin panel. The vulnerability was discovered by thiennv and has been patched in version 3.4.4 and later.

Based on public CVE data (MITRE/NVD).