WordPress The7 Theme <= 11.7.3 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-32123

7.1HIGH

Key Information:

Vendor

WordPress
Status
The7
Vendor
CVE Published:
13 November 2023

What is CVE-2023-32123?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Dream-Theme The7, which can allow attackers to exploit the application through unauthorized requests. This issue can potentially lead to Stored Cross-Site Scripting (XSS) attacks in affected versions, compromising user security and site integrity. Organizations using The7 need to implement proper security measures and updates to protect against such attacks. Users should ensure their installation is on version 11.7.4 or later to mitigate the risk.

Affected Version(s)

The7 <= 11.7.3

References

https://patchstack.com/database/vulnerability/dt-the7/wor...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dave Jong (Patchstack)
.