WordPress Plugin Vulnerabilities

WP EXtra < 6.5 - Cross-Site Request Forgery ToolImport

Description

The WP EXtra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.4. This is due to missing or incorrect nonce validation on the ToolImport function. This makes it possible for unauthenticated attackers to change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
wp-extra
Fixed in 6.5

References

CVE
CVE-2023-47825
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3f3104-e213-4b0f-9821-b3f1a5c06191

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Huynh Tien Si
Verified
No
WPVDB ID
0a3034b0-4243-4100-b8a7-04fe850edad1

Timeline

Publicly Published
2023-11-16 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2023-12-22
Title
Add Any Extension to Pages < 1.5 - Cross-Site Request Forgery via aaetp_options_page
Published
2025-04-24
Title
Custom Functions Plugin <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-07-12
Title
Justin Klein WP Social AutoConnect < 4.6.2 - Cross-Site Request Forgery
Published
2021-07-05
Title
Advanced Post Listing Shortcode <= 2.8 - CSRF Bypass
Published
2025-04-04
Title
Rollbar < 3.0.0 - Cross-Site Request Forgery