WordPress Add Local Avatar Plugin <= 12.1 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-47650

8.8HIGH

Key Information:

Vendor

WordPress
Status
Add Local Avatar
Vendor
CVE Published:
18 November 2023

What is CVE-2023-47650?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Add Local Avatar plugin by Peter Sterling. This flaw allows attackers to potentially execute unauthorized actions on behalf of authenticated users, leading to unintended consequences. The plugin versions affected range from n/a to 12.1, making it crucial for users to apply necessary updates or patches to secure their installations.

Affected Version(s)

Add Local Avatar <= 12.1

References

https://patchstack.com/database/vulnerability/add-local-a...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LEE SE HYOUNG (Patchstack Alliance)
.