WordPress Plugin Vulnerabilities

wpDiscuz < 7.6.12 - Cross-Site Request Forgery

Description

The wpDiscuz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.6.11. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to dismiss admin notices via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
wpdiscuz
Fixed in 7.6.12

References

CVE
CVE-2023-47775
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/53af9dfd-eb2d-4f6f-b02f-daf790b95f1f

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Vladislav Pokrovsky (ΞX.MI)
Verified
No
WPVDB ID
f8dfcc13-187c-4a83-a87e-761c0db4b6d9

Timeline

Publicly Published
2023-11-14 (about 2 years ago)
Added
2023-11-24 (about 2 years ago)
Last Updated
2024-01-22 (about 2 years ago)

Other

Published
Title
Published
2022-07-05
Title
Visualizer: Tables and Charts Manager for WordPress < 3.7.10 - Contributor+ PHAR Deserialization
Published
2015-04-02
Title
WordPress Video Gallery <= 2.8 - Multiple Cross-Site Request Forgery (CSRF)
Published
2025-10-02
Title
Comment Info Detector <= 1.0.5 - Cross-Site Request Forgery to Settings Update
Published
2025-01-16
Title
Web Testimonials <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2022-05-16
Title
Discy < 5.2 - Restore Default Settings via CSRF