WordPress WpStream – Live Streaming, Video on Demand, Pay Per View Plugin <= 4.5.4 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-38512

8.8HIGH

Key Information:

Vendor
WordPress
Status
WpStream – Live Streaming, Video on Demand, Pay Per View
Vendor
CVE Published:
27 July 2023

Summary

The Wpstream plugin, a solution for live streaming, video on demand, and Pay Per View functionalities in WordPress, contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 4.5.4. This security flaw may allow unauthorized parties to perform actions on behalf of an authenticated user, potentially compromising user accounts and their associated data. It is crucial for users to update to the latest version to mitigate this security risk.

Affected Version(s)

WpStream – Live Streaming, Video on Demand, Pay Per View <= 4.5.4

References

https://patchstack.com/database/vulnerability/wpstream/wo...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elliot (Patchstack Alliance)
.