What the vulnerability does
01Description
A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the function exitboxadmin of the file wordpress-exit-box-lite.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.10 is able to address this issue. The patch is named fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230671.
Explanation of Vulnerability in Simple Terms
02Summary
The Exit Box Lite plugin contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in site administrator. An attacker can craft a malicious webpage that, when visited by an admin, triggers unwanted changes to the plugin's settings or configuration. No authentication is required from the attacker's side, but the victim must visit the attacker's page while logged into WordPress.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into changing the plugin's settings or configuration without their knowledge.
Potential impact on your site
04Site Impact
Plugin settings could be altered maliciously if an admin visits a compromised or attacker-controlled site.
Conditions required to exploit
05Prerequisites
Admin must visit attacker-controlled webpage while logged into WordPress.
Key dates
06Disclosure timeline
June 5, 2023
CVE published
November 22, 2024
Record updated
