WordPress Plugin Vulnerabilities

Skrill Official < 1.0.67 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
official-skrill-woocommerce
Fixed in 1.0.67

References

CVE
CVE-2025-28876
URL
https://patchstack.com/database/wordpress/plugin/official-skrill-woocommerce/vulnerability/wordpress-skrill-official-plugin-1-0-65-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Skalucy
Verified
No
WPVDB ID
0440ec41-d796-4082-9203-d417717b521e

Timeline

Publicly Published
2025-03-11 (about 1 year ago)
Added
2025-03-17 (about 1 year ago)
Last Updated
2025-03-18 (about 1 year ago)

Other

Published
Title
Published
2024-07-08
Title
Attachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload
Published
2024-03-25
Title
Advance Search <= 1.1.6 - Shortcode Deletion via CSRF
Published
2023-12-28
Title
Icegram < 3.1.19 - Cross-Site Request Forgery via save_campaign_preview
Published
2026-01-24
Title
Term Order < 2.2.0 - Cross-Site Request Forgery
Published
2023-04-03
Title
Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRF