Client Portal Vulnerabilities

The Client Portal – Private user pages and login plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized a...

CVSS:

6.5

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Jan 16, 2026

CVE-2026-25003 on NVD →

The Client Portal – Private user pages and login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.8. This is due to missing or incorrect nonce validation on the 'cp_create_private_pages_for_all_users' function. This makes it possible for unauthenticated attackers to...

CVSS:

5.4

Affected:

up to 1.1.8

Fixed in:

1.1.9

Disclosed:

Feb 22, 2023

CVE-2023-25968 on NVD →

The Client Portal plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.8. This is due to missing nonce validation on the cp_create_private_pages_for_all_users function. This makes it possible for unauthenticated attackers to generate private pages for all users, via a f...

CVSS:

4.3

Affected:

up to 1.1.8

Fixed in:

1.1.9

Disclosed:

Feb 21, 2023