Cross-Site Request Forgery Vulnerability in Better Search Plugin for WordPress
CVE-2021-4400
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 1 July 2023
What is CVE-2021-4400?
The Better Search plugin for WordPress is exposed to a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 2.5.2. This flaw arises from a lack of proper nonce validation in the bsearch_process_settings_import() and bsearch_process_settings_export() functions. An attacker can exploit this vulnerability by tricking an authenticated site administrator into clicking a malicious link, potentially allowing unauthorized settings import and export actions via forged requests.
Affected Version(s)
Better Search – Relevant search results for WordPress * <= 2.5.2