Cross-Site Request Forgery (CSRF)

wordpress is vulnerable to cross-site request forgery (CSRF). The vulnerability exists as it does not have any CSRF protections in place to prevent forged request when posting comments. Moreover, a lack of comment content filtering when an administrative user posts a comment, allows a remote attacker to exploit the CSRF vulnerability to perform a cross-site scripting attack to inject arbitrary Javascript via the comments. Successful execution of the exploit would allow the attacker to modify .php files from the administrative user’s context to execute arbitrary code.