What the vulnerability does
01Description
A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this issue is the function exitpageadmin of the file exitpage.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.59 is able to address this issue. The patch is identified as d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. VDB-225266 is the identifier assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Exit Strategy Plugin contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in user. An attacker can craft a malicious link or page that, when visited by a site administrator, executes unintended plugin operations. No authentication is required from the attacker, but the victim must click the link or visit the page.
What an attacker can do
03Attacker Capabilities
Perform unauthorized plugin actions on behalf of a logged-in administrator without their knowledge.
Potential impact on your site
04Site Impact
An attacker can trick administrators into changing plugin settings or performing actions they did not intend.
Conditions required to exploit
05Prerequisites
A site administrator must visit an attacker-controlled page or click a malicious link while logged in.
Key dates
06Disclosure timeline
April 8, 2023
CVE published
August 6, 2024
Record updated
