Cross-Site Request Forgery in WP Security Question Plugin for WordPress

CVE-2021-4386

What is CVE-2021-4386?

The WP Security Question plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation within its save() function. This vulnerability allows unauthenticated attackers to manipulate plugin settings, provided they can deceive a site administrator into initiating a request, potentially through malicious links. Because of this oversight, attackers can exploit this weakness to make unauthorized changes to the site configuration.

References