What the vulnerability does
01Description
A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 2.15 is able to address this issue. The patch is identified as a6d4659cbb2cbf18ccb0fb43549d5113d74e0146. It is recommended to upgrade the affected component. VDB-230154 is the identifier assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Twitter Plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated site administrator. An attacker can craft a malicious link or page that, when visited by an admin, executes unintended plugin operations. No authentication is required from the attacker's side, but the admin must click the link or visit the page.
What an attacker can do
03Attacker Capabilities
Perform unauthorized plugin actions on behalf of a logged-in site administrator without their knowledge.
Potential impact on your site
04Site Impact
An attacker can modify plugin settings or trigger plugin functions by tricking an admin into visiting a crafted page.
Conditions required to exploit
05Prerequisites
Site administrator must visit a malicious link or page while logged into WordPress.
Key dates
06Disclosure timeline
May 30, 2023
CVE published
August 6, 2024
Record updated
