Cross site request forgery (csrf)

2023-10-2712:15:00

PRIOn knowledge base

www.prio-n.com

cross-site request forgery

wordpress

vulnerability

arbitrary files

nvd

nonce validation

unauthenticated attackers

site administrator

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.9%

JSON

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the addedit functionality. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References

plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1263536%40wp-responsive-slider-with-lightbox&new=1263536%40wp-responsive-slider-with-lightbox&sfp_email=&sfph_mail=

wordpress.org/plugins/wp-responsive-slider-with-lightbox

www.wordfence.com/threat-intel/vulnerabilities/id/e51e1cd2-6de9-4820-8bba-1c6b5053e2c1?source=cve