Cross-Site Request Forgery Vulnerability in Audio Merchant Plugin for WordPress

CVE-2023-6197

What is CVE-2023-6197?

The Audio Merchant plugin for WordPress, present in all versions up to 5.0.4, has a vulnerability that allows unauthenticated attackers to exploit missing or incorrect nonce validation in the audio_merchant_save_settings function. By sending a forged request, an attacker can manipulate plugin settings and potentially insert malicious scripts. This exploitation requires the attacker to deceive a site administrator into executing a specific action, such as clicking a malicious link, which could compromise the security of the WordPress site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References