WordPress Travelpayouts plugin < 1.1.13 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Erwan LR WPScan in WordPress Plugin Travelpayouts versions 1.1.13...

CVE-2023-5934

creationtimestamp| type| source ---|---|--- 2025-05-16 19:34:46+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16745...

CVE-2023-5934 Travelpayouts < 1.1.13 - Settings Update via CSRF

The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack...

CVE-2023-5934

The Travelpayouts: All Travel Brands in One Place WordPress plugin versions prior to 1.1.13 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when importing settings from the v1 source. This vulnerability could allow an attacker to trick a logged...