Cross-Site Request Forgery in GMAce Plugin for WordPress
CVE-2023-1509
8.8HIGH
Summary
The GMAce plugin for WordPress, in versions up to and including 1.5.2, is susceptible to Cross-Site Request Forgery due to a failure in nonce validation within the gmace_manager_server function. This vulnerability allows unauthorized attackers to exploit this oversight, potentially modifying arbitrary files and executing remote code by tricking a site administrator into executing a malicious request. Administrators should apply the necessary updates to protect their sites from such forged actions.
Affected Version(s)
GMAce * <= 1.5.2
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Lana Codes