What the vulnerability does
01Description
A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70. It is recommended to upgrade the affected component. VDB-230658 is the identifier assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Blogger Importer Plugin contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unwanted actions on behalf of an authenticated user. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, triggers unintended plugin operations. No authentication is required from the attacker, but the victim must click the link or visit the page.
What an attacker can do
03Attacker Capabilities
Perform plugin actions on behalf of a logged-in administrator without their knowledge.
Potential impact on your site
04Site Impact
An attacker can trick administrators into performing unintended plugin operations, potentially compromising blog imports or settings.
Conditions required to exploit
05Prerequisites
Victim must be logged in and click a malicious link or visit an attacker-controlled page.
Key dates
06Disclosure timeline
June 4, 2023
CVE published
August 6, 2024
Record updated
