WordPress Plugin Vulnerabilities

OptiMonk < 2.0.5 - Account ID Update via CSRF

Description

The plugin does not have CSRF check when updating its account ID setting, which could allow attackers to make logged in admins perform such action via a CSRF attack

Affects Plugins

Plugin icon
exit-intent-popups-by-optimonk
Fixed in 2.0.5

References

CVE
CVE-2023-37891

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
5c3b4dc5-8a08-47a7-a364-1b5e6b4d41ef

Timeline

Publicly Published
2023-07-11 (about 2 years ago)
Added
2023-10-11 (about 2 years ago)
Last Updated
2023-10-11 (about 2 years ago)

Other

Published
Title
Published
2021-02-05
Title
Name Directory < 1.18 - Cross-Site Request Forgery (CSRF)
Published
2024-08-12
Title
Backup and Restore WordPress <= 1.50 - Cross-Site Request Forgery
Published
2025-09-26
Title
HotelRunner Booking Widget <= 1.6 - Cross-Site Request Forgery
Published
2026-01-10
Title
Merge + Minify + Refresh < 2.15 - Cross-Site Request Forgery
Published
2014-08-01
Title
IndiaNIC Testimonial 2.2 - Setting Manipulation CSRF