WordPress Plugin Vulnerabilities

wpCentral <= 1.5.7 - Settings Update via CSRF

Description

The plugin does not have CSRF checks when updating allowed IP addresses and reseting connection key, which could allow attackers to make logged in admins perform such actions via CSRF attacks

Affects Plugins

Plugin icon
wp-central
No known fix

References

CVE
CVE-2023-41854

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Rio Darmawan
Verified
No
WPVDB ID
0d475640-035a-4dff-b022-e40374514b59

Timeline

Publicly Published
2023-09-05 (about 2 years ago)
Added
2023-10-10 (about 2 years ago)
Last Updated
2023-10-10 (about 2 years ago)

Other

Published
Title
Published
2022-08-25
Title
Better Font Awesome < 2.0.2 - Settings Update via CSRF
Published
2024-04-10
Title
The Conference < 1.2.1 - Cross-Site Request Forgery to Notice Dismissal
Published
2024-03-25
Title
Paid Memberships Pro < 3.0 - Cross-Site Request Forgery
Published
2023-03-14
Title
Google XML Sitemap for Images <= 2.1.3 - Map generation through CSRF
Published
2024-11-22
Title
Zajax – Ajax Navigation <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting