CVE-2023-1623: Webdevstudios Custom Post Type UI

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack.

Affected products

• Webdevstudios Custom Post Type UI: before 1.13.5 (fixed in 1.13.5)

Published 2023-04-24. Last modified 2026-06-17.