CVE-2023-1623: 
WordPress vulnerability analysis and mitigation

The Custom Post Type UI WordPress plugin versions before 1.13.5 contained a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2023-1623. The vulnerability was discovered and publicly disclosed on April 3, 2023. The issue specifically affects the debug information sending functionality of the plugin, which lacks proper CSRF protection (WPScan).

The vulnerability is classified as a CSRF (Cross-Site Request Forgery) issue, identified under CWE-352. It received a CVSS 3.1 score indicating low severity. The technical issue stems from improper CSRF protection mechanisms when handling debug information sending functionality to user-supplied email addresses (WPScan).

The vulnerability could allow attackers to force a logged-in administrator to send debug information to an arbitrary email address through a CSRF attack. This could potentially lead to unauthorized disclosure of sensitive debug information to unintended recipients (WPScan).

The exploit requires an attacker to make a logged-in administrator open a specially crafted page containing malicious HTML code. The vulnerability has been verified by security researchers, though there are no known reports of active exploitation in the wild (WPScan).

The vulnerability has been patched in version 1.13.5 of the Custom Post Type UI plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan, Trustwave).