WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-52123

8.8HIGH

Key Information:

Vendor
WordPress
Status
Strong Testimonials
Vendor
CVE Published:
5 January 2024

Summary

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WPChill Strong Testimonials plugin, which permits unauthorized actions to be carried out on behalf of authenticated users. This weakness potentially allows attackers to manipulate user settings or conduct administrative actions without consent. The affected versions span from an unspecified earlier version up to 3.1.10, posing a risk to WordPress site administrators and users relying on the plugin for testimonial management. Timely updates and security measures are essential to mitigate the risks associated with this vulnerability.

Affected Version(s)

Strong Testimonials <= 3.1.10

References

https://patchstack.com/database/vulnerability/strong-test...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brandon Roldan (Patchstack Alliance)
.