What the vulnerability does
01Description
A vulnerability was found in meitar Inline Google Spreadsheet Viewer Plugin up to 0.9.6 on WordPress and classified as problematic. Affected by this issue is the function displayShortcode of the file inline-gdocs-viewer.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 0.9.6.1 is able to address this issue. The patch is identified as 2a8057df8ca30adc859cecbe5cad21ac28c5b747. It is recommended to upgrade the affected component. VDB-230234 is the identifier assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Inline Google Spreadsheet Viewer Plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the administrator's knowledge or consent. The vulnerability requires user interaction—the admin must visit the attacker's page while logged in.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on the site by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
04Site Impact
An attacker can modify site settings or content if they trick an admin into clicking a malicious link while logged in.
Conditions required to exploit
05Prerequisites
A logged-in WordPress administrator must visit an attacker-controlled webpage.
Key dates
06Disclosure timeline
May 31, 2023
CVE published
August 6, 2024
Record updated
