CVE-2023-5311

🗓️ 25 Oct 2023 07:36:02Reported by WordfenceType

The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the .htaccess files and achieve remote code execution

Reporter	Title	Published	Views	Family All 12
CNNVD	WordPress Plugin WP Extra Security Vulnerability	25 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-5311 WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification	25 Oct 202307:36	–	cvelist
EUVD	EUVD-2023-57634	3 Oct 202520:07	–	euvd
NVD	CVE-2023-5311	25 Oct 202318:17	–	nvd
OSV	CVE-2023-5311	25 Oct 202318:17	–	osv
Prion	Remote code execution	25 Oct 202318:17	–	prion
Positive Technologies	PT-2023-32031 · WordPress · Wp Extra	25 Oct 202300:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2023-5311: Missing Authorization	25 Oct 202300:00	–	rapid7
RedhatCVE	CVE-2023-5311	23 May 202504:31	–	redhatcve
Vulnrichment	CVE-2023-5311 WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification	25 Oct 202307:36	–	vulnrichment

NVD

Vulners

Node

wpvnteam wp_extraRange<6.3wordpress

[
  {
    "vendor": "wpvncom",
    "product": "WP EXtra – One Click Optimize",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "6.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/2977703/wp-extra
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/87e3dd5e-0d77-4d78-8171-0beaf9482699
giongfnef	www.giongfnef.gitbook.io/giongfnef/cve/cve-2023-5311

17 Jun 2026 06:48Current

7.4High risk

Vulners AI Score7.4

CVSS 3.18.8

EPSS0.01443

SSVC

CWE-862

wp extra wordpress vulnerability unauthorized modification data capability check register function nvd cve-2023-5311