CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
What the vulnerability does
WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.
Explanation of Vulnerability in Simple Terms
Curtain versions 1.0.2 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in user, performs unwanted actions on their behalf. The vulnerability requires the victim to be authenticated and visit a attacker-controlled page. This can lead to unauthorized modifications or data changes within the application.
What an attacker can do
Perform unauthorized actions on behalf of a logged-in user by tricking them into visiting a malicious webpage.
Potential impact on your site
Users' accounts can be manipulated to perform unintended actions without their knowledge or consent.
Conditions required to exploit
Victim must be logged in to Curtain and visit an attacker-controlled webpage.
Key dates
External resources
Related vulnerabilities
