WordPress Plugin Vulnerabilities

Spam protection, AntiSpam, FireWall by CleanTalk < 6.21 - Email Update via CSRF

Description

The plugin does not have CSRF check in its apbct_settings__update_account_email function, which could allow attackers to make logged in admins update email address via a CSRF attack

Affects Plugins

Plugin icon
cleantalk-spam-protect
Fixed in 6.21

References

CVE
CVE-2023-51696
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/19dd6670-2813-4944-abcd-c26fb9b82092

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Elliot
Verified
No
WPVDB ID
9ba44969-d6d0-4933-80fc-f954acf7ed4a

Timeline

Publicly Published
2023-12-27 (about 2 years ago)
Added
2024-01-04 (about 2 years ago)
Last Updated
2024-01-04 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Polldaddy Polls & Ratings 2.0.20 - Cross-Site Request Forgery
Published
2019-08-23
Title
WooCommerce Address Book < 1.6.0 - CSRF
Published
2024-06-06
Title
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) < 5.2.4 - Cross-Site Request Forgery
Published
2024-08-22
Title
ILC Thickbox <= 1.0 - Settings update via CSRF
Published
2023-04-04
Title
Comment Reply Notification <= 1.4 - Cross-Site Request Forgery