WordPress Plugin Vulnerabilities

WpStream < 4.5.5 - Local Event Settings Update via CSRF

Description

The plugin does not have CSRF check when updating its local event settings, which could allow attackers to make logged in admin perform such action via a CSRF attack

Affects Plugins

Plugin icon
wpstream
Fixed in 4.5.5

References

CVE
CVE-2023-38512

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Elliot
Verified
No
WPVDB ID
90389f0f-d7bb-44b8-8323-a9e3c3311d9c

Timeline

Publicly Published
2023-07-20 (about 2 years ago)
Added
2023-08-07 (about 2 years ago)
Last Updated
2023-08-07 (about 2 years ago)

Other

Published
Title
Published
2023-04-05
Title
WCFM Frontend Manager < 6.6.0 - Multiple CSRF
Published
2024-04-11
Title
Sync Post With Other Site < 1.5.2 - Cross-Site Request Forgery
Published
2023-04-07
Title
Simple Job Board < 2.10.4 - Settings Update via CSRF
Published
2023-09-27
Title
Woocommerce ESTO < 2.23.2 - Settings Update via CSRF
Published
2021-07-05
Title
Locations < 4.0 - Cross-Site Request Forgery