CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.
Explanation of Vulnerability in Simple Terms
The Email Templates Customizer and Designer plugin for WordPress and WooCommerce versions up to 1.4.2 is vulnerable to cross-site request forgery (CSRF). An attacker can trick a logged-in site administrator into performing unwanted actions, such as modifying email templates or plugin settings, by sending them a malicious link or embedding code on a webpage. The vulnerability requires the admin to click the link or visit the attacker's page while logged into WordPress.
What an attacker can do
Trick a logged-in admin into modifying email templates or plugin settings without their knowledge.
Potential impact on your site
Attackers can alter email templates or plugin configuration, potentially disrupting customer communications or injecting malicious content.
Conditions required to exploit
Admin must be logged into WordPress and click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
