CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in 闪电博 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 allows Cross Site Request Forgery.This issue affects 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条: from n/a through 4.2.7.
Explanation of Vulnerability in Simple Terms
A cross-site request forgery (CSRF) vulnerability in the Lightning Blog multi-search auto-push management plugin allows an attacker to perform unauthorized actions on behalf of an authenticated site administrator. The vulnerability requires the admin to visit a malicious webpage while logged in. An attacker can modify plugin settings, alter search engine submission configurations, or disable the plugin entirely without the admin's knowledge or consent.
What an attacker can do
Perform unauthorized actions on the plugin (change settings, disable features) by tricking a logged-in admin into visiting a malicious page.
Potential impact on your site
Plugin settings and search engine submission configurations can be altered or disabled without your knowledge, disrupting SEO automation.
Conditions required to exploit
Site admin must be logged in and visit an attacker-controlled webpage; no special privileges or direct site access required.
Key dates
External resources
Related vulnerabilities
