Cross-Site Request Forgery in Thumbnail Carousel Slider Plugin for WordPress

CVE-2023-5821

What is CVE-2023-5821?

The Thumbnail carousel slider plugin for WordPress has a security flaw allowing unauthenticated attackers to issue requests that could delete sliders in bulk. This vulnerability stems from a lack of nonce validation in the deleteselected function. An attacker could exploit this by tricking a site administrator into clicking a malicious link, thereby executing the delete action without proper authorization.

References