WordPress Plugin Vulnerabilities

OOPSpam Anti-Spam < 1.1.45 - Cross-Site Request Forgery

Description

The plugin does not adequately verify requests use nonces, leading to a potential Cross-Site Request Forgery vulnerability.

Affects Plugins

Plugin icon
oopspam-anti-spam
Fixed in 1.1.45

References

CVE
CVE-2023-35913
URL
https://patchstack.com/database/vulnerability/oopspam-anti-spam/wordpress-oopspam-anti-spam-plugin-1-1-44-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Skalucy
Verified
No
WPVDB ID
bf9d8ba3-17c8-4133-a312-ec639af11d89

Timeline

Publicly Published
2023-06-23 (about 2 years ago)
Added
2023-07-11 (about 2 years ago)
Last Updated
2023-07-11 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Simple Fields 1.1.6 - Admin Functions CSRF
Published
2022-01-24
Title
Coming soon and Maintenance mode < 3.6.8 - Arbitrary Email Sending to Subscribed Users via CSRF
Published
2023-06-26
Title
WooCommerce Google Sheet Connector < 1.3.6 - Access Code Update via CSRF
Published
2023-02-10
Title
Under Construction < 3.97 - Multiple CSRF
Published
2025-04-17
Title
Theme Changer < 1.5 - Cross-Site Request Forgery