WordPress Ultimate Noindex Nofollow Tool II Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-30474

8.8HIGH

Key Information:

Vendor

WordPress
Status
Ultimate Noindex Nofollow Tool II
Vendor
CVE Published:
16 April 2023

What is CVE-2023-30474?

The Kilian Evang Ultimate Noindex Nofollow Tool II plugin for WordPress is affected by a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of a user. This vulnerability impacts versions of the plugin up to and including 1.3, potentially compromising the integrity of user accounts and allowing malicious actions to be executed without user consent, making it vital for users of the plugin to implement necessary security measures.

Affected Version(s)

Ultimate Noindex Nofollow Tool II <= 1.3

References

https://patchstack.com/database/vulnerability/ultimate-no...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdi Pranata (Patchstack Alliance)
.
CVE-2023-30474 : WordPress Ultimate Noindex Nofollow Tool II Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)