Cross-Site Request Forgery Vulnerability in WPUpper Share Buttons Plugin for WordPress

CVE-2024-13883

What is CVE-2024-13883?

The WPUpper Share Buttons plugin for WordPress suffers from a vulnerability that allows unauthenticated attackers to exploit missing or incorrect nonce validation in the 'save_custom_css_request' function. This security gap permits the injection of custom CSS through a forged request, which can alter the appearance and functionality of a website. Attackers can potentially trick site administrators into executing such actions by manipulating links, placing sensitive data at risk and undermining the integrity of web applications.

References