Cross-Site Request Forgery Vulnerability in Audio Merchant Plugin for WordPress

CVE-2023-6197

Summary

The Audio Merchant plugin for WordPress, present in all versions up to 5.0.4, has a vulnerability that allows unauthenticated attackers to exploit missing or incorrect nonce validation in the audio_merchant_save_settings function. By sending a forged request, an attacker can manipulate plugin settings and potentially insert malicious scripts. This exploitation requires the attacker to deceive a site administrator into executing a specific action, such as clicking a malicious link, which could compromise the security of the WordPress site.

References