WordPress Plugin Vulnerabilities

ShortPixel Adaptive Images < 3.7.2 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
shortpixel-adaptive-images
Fixed in 3.7.2

References

CVE
CVE-2023-32512

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
konagash
Verified
No
WPVDB ID
b2cd4159-bb83-4456-ac8a-237425269fc5

Timeline

Publicly Published
2023-05-08 (about 3 years ago)
Added
2023-11-13 (about 2 years ago)
Last Updated
2023-11-13 (about 2 years ago)

Other

Published
Title
Published
2024-07-01
Title
pz-frontend-manager < 1.0.6 - CSRF change user profile picture
Published
2025-03-24
Title
CallPhone'r <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-07-14
Title
WP Testimonials < 1.4.3 - Widget Deletion via CSRF
Published
2026-01-13
Title
RealPress – Real Estate Plugin < 1.1.1 - Cross-Site Request Forgery
Published
2022-02-01
Title
Easy Pricing Tables < 3.1.3 - Arbitrary Post Removal via CSRF