Cross-Site Request Forgery Risk in My Sticky Bar Plugin for WordPress

CVE-2023-7048

Summary

The My Sticky Bar plugin for WordPress is exposed to a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in the mystickymenu-contact-leads.php file. All versions up to and including 2.6.6 are affected. This flaw allows unauthorized attackers to exploit the system by tricking a legitimate site administrator into executing a malicious action, such as clicking on an infected link. When executed, the attack can trigger the export of a CSV file containing sensitive contact lead information to a publicly accessible location, where it can be retrieved shortly before automatic deletion occurs. This vulnerability highlights the critical importance of implementing proper security measures to protect sensitive data from unauthorized access.

References