Favicon Generator Plugin Vulnerable to Cross-Site Request Forgery

CVE-2024-7568

Summary

The Favicon Generator plugin for WordPress exhibits a vulnerability related to Cross-Site Request Forgery (CSRF). This weakness stems from inadequate nonce validation within the output_sub_admin_page_0 function, allowing unauthorized entities to manipulate the plugin's actions. An attacker can potentially eliminate arbitrary files from the server if they manage to deceive an administrator into activating a malicious link. As a crucial mitigation step, the plugin's author has removed this functionality, urging users to transition to alternative options due to the closure of the plugin.

References