Cross-Site Request Forgery in WP SMS Plugin for WordPress

CVE-2023-6980

What is CVE-2023-6980?

The WP SMS – Messaging & SMS Notification plugin for WordPress is prone to a Cross-Site Request Forgery vulnerability in the wp-sms-subscribers page, affecting all versions up to and including 6.5. This vulnerability arises from inadequate nonce validation on the 'delete' action. Attackers can exploit this flaw to manipulate site functionalities by deceiving a site administrator into executing an unintended command via a malicious link, potentially leading to unauthorized deletion of subscriber data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References