WordPress Plugin Vulnerabilities

Better Notifications for WP < 1.9.3 - Cross-Site Request Forgery (CSRF)

Description

The plugin does not protect its handle_actions function against CSRF attacks, allowing an unauthenticated attacker to enable or disable notifications by tricking a logged in administrator to submit a crafted request.

Affects Plugins

Plugin icon
bnfw
Fixed in 1.9.3

References

CVE
CVE-2023-32964
URL
https://patchstack.com/database/vulnerability/bnfw/wordpress-better-notifications-for-wp-plugin-1-9-2-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nguyen Xuan Chien
Verified
No
WPVDB ID
383235d4-8ee4-4909-b8d9-7afc09aa424e

Timeline

Publicly Published
2023-05-18 (about 2 years ago)
Added
2023-05-29 (about 2 years ago)
Last Updated
2023-05-29 (about 2 years ago)

Other

Published
Title
Published
2025-07-30
Title
Ebook Store < 5.8014 - Cross-Site Request Forgery
Published
2025-08-24
Title
Off-Canvas Sidebars & Menus (Slidebars) < 0.5.9 - Cross-Site Request Forgery
Published
2022-12-14
Title
ipBlockList <= 1.0 - CSRF
Published
2025-01-16
Title
Twitter Shortcode <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-04-25
Title
CheckBot <= 1.05 - Cross-Site Request Forgery to Stored Cross-Site Scripting