Cross-Site Request Forgery in WP SMS Plugin for WordPress

CVE-2023-6980

What is CVE-2023-6980?

The WP SMS – Messaging & SMS Notification plugin for WordPress is prone to a Cross-Site Request Forgery vulnerability in the wp-sms-subscribers page, affecting all versions up to and including 6.5. This vulnerability arises from inadequate nonce validation on the 'delete' action. Attackers can exploit this flaw to manipulate site functionalities by deceiving a site administrator into executing an unintended command via a malicious link, potentially leading to unauthorized deletion of subscriber data.

References