What the vulnerability does
01Description
A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_new_favicon of the file admin/class-favicon-by-realfavicongenerator-admin.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.2.13 is able to address this issue. The identifier of the patch is 949a1ae7216216350458844f50a72f100b56d4e7. It is recommended to upgrade the affected component. The identifier VDB-230661 was assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Favicon Plugin for RealFaviconGenerator contains a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the site without the admin's knowledge or consent. The vulnerability requires the admin to visit the attacker's page while authenticated to the WordPress site.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on the site by tricking an authenticated admin into visiting a malicious webpage.
Potential impact on your site
04Site Impact
An attacker can modify favicon settings or other plugin functions without your permission if you visit a malicious link while logged in.
Conditions required to exploit
05Prerequisites
Site admin must be logged in and visit an attacker-controlled webpage; no special privileges or direct site access required.
Key dates
06Disclosure timeline
June 6, 2023
CVE published
August 6, 2024
Record updated
