Cross-Site Request Forgery Vulnerability in Stream Plugin for WordPress

CVE-2024-7423

Summary

The Stream plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation within its network_options_action() function. This vulnerability affects all versions up to and including 4.0.1. As a result, unauthenticated attackers could exploit this issue to send forged requests, tricking site administrators into performing unintended actions. Such actions may allow attackers to alter arbitrary options within the plugin, potentially leading to Denial of Service (DoS) attacks or privilege escalation. Proper validation processes are essential to mitigate this risk and safeguard against unauthorized access.

References