WordPress Webpushr Plugin <= 4.34.0 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-35041

8.8HIGH

Key Information:

Vendor

WordPress
Status
Web Push Notifications – Webpushr
Vendor
CVE Published:
13 November 2023

What is CVE-2023-35041?

This vulnerability is a Cross-Site Request Forgery (CSRF) issue that can lead to Local File Inclusion (LFI) in versions of the Webpushr Web Push Notifications plugin up to 4.34.0. An attacker can exploit this weakness to manipulate user actions without their consent, potentially allowing unauthorized access to sensitive files on the server.

Affected Version(s)

Web Push Notifications – Webpushr <= 4.34.0

References

https://patchstack.com/database/vulnerability/webpushr-we...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Theodoros Malachias (Patchstack Alliance)
.