Cross-Site Request Forgery in Feather Login Page Plugin for WordPress

CVE-2023-2549

What is CVE-2023-2549?

The Feather Login Page plugin for WordPress contains a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in the 'createTempAccountLink' function. This flaw allows unauthorized individuals to exploit the plugin by tricking site administrators into submitting forged requests. As a result, an attacker could create a new user with administrative privileges, potentially compromising the entire site. Attackers may also use related vulnerabilities to obtain login links or initiate password reset requests to the newly created user’s email.

References