Cross-Site Request Forgery Vulnerability in GiveWP Plugin for WordPress
CVE-2023-4246
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 11 January 2024
What is CVE-2023-4246?
The GiveWP plugin for WordPress is prone to a Cross-Site Request Forgery vulnerability due to inadequate nonce validation within the give_sendwp_remote_install_handler function. This security flaw can be exploited by unauthenticated attackers who trick site administrators into executing malicious requests, potentially leading to unauthorized installation and activation of the SendWP plugin. Administrators should ensure their sites are updated to prevent exploitation of this vulnerability.
Affected Version(s)
GiveWP – Donation Plugin and Fundraising Platform * <= 2.33.3