WordPress CALL ME NOW Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-32602

8.8HIGH

Key Information:

Vendor
WordPress
Status
Call Me Now
Vendor
CVE Published:
9 November 2023

Summary

A Cross-Site Request Forgery (CSRF) vulnerability has been detected in the LOKALYZE CALL ME NOW plugin for WordPress, affecting versions up to and including 3.0. This vulnerability allows unauthorized actions to be executed on behalf of users, potentially compromising their account security and the integrity of the web application. It is crucial for users and administrators of this plugin to implement necessary updates and security measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

CALL ME NOW <= 3.0

References

https://patchstack.com/database/vulnerability/lokalyze-ca...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuki Haruma (Patchstack Alliance)
.