Multiple CSRF Vulnerabilities in HMS Testimonials Plugin for WordPress

CVE-2013-4240

Summary

The HMS Testimonials plugin for WordPress prior to version 2.0.11 is susceptible to multiple cross-site request forgery (CSRF) vulnerabilities, allowing remote attackers to exploit this weakness. By leveraging these vulnerabilities, an attacker can manipulate an authenticated administrator’s session to perform unauthorized actions. Specifically, this includes the ability to add new testimonials, create new groups, and modify both default and advanced settings under the WordPress admin panel. This manipulation can lead to significant unauthorized changes within the WordPress site, underscoring the importance of promptly updating to the secured version of the plugin.

References