ClickCease Click Fraud Protection <= 3.2.5 - Cross-Site Request Forgery

2024-05-0100:00:00

wpscan.com

plugin

vulnerability

cross-site request forgery

nonce validation

unauthorized actions

forged request

unauthenticated attackers

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.7%

JSON

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References

patchstack.com/database/vulnerability/clickcease-click-fraud-protection/wordpress-clickcease-click-fraud-protection-plugin-3-2-4-cross-site-request-forgery-csrf-vulnerability