Cross-Site Request Forgery Vulnerability in ThePerfectWedding.nl Widget Plugin for WordPress

CVE-2024-12322

What is CVE-2024-12322?

ThePerfectWedding.nl Widget plugin for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation in the 'update_option' function. This vulnerability allows unauthenticated attackers to exploit the weakness by tricking a site administrator into performing actions that trigger unauthorized updates to the 'tpwKey' option. As a result, malicious actors can potentially inject stored cross-site scripting through forged requests, compromising the site's integrity.

References