CVE-2023-26535 MEDIUM

CVE-2023-26535: WordPress Sheets To WP Table Live Sync Plugin <= 2.12.15 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Wppool

Product Sheets To WP Table Live Sync

Weakness CWE-352 · CSRF

Published November 22, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Sheets To WP Table Live Sync versions up to 2.12.15 lack CSRF protection on key actions. An attacker can trick a logged-in site admin into visiting a malicious page that performs unwanted changes to the plugin's settings or data. The attack requires the admin to click a link or visit a page while authenticated.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into modifying plugin settings or data without their knowledge.

Potential impact on your site

04Site Impact

Plugin settings or synced data could be altered by an attacker without your consent or awareness.

Conditions required to exploit

05Prerequisites

Admin must be logged in and visit an attacker-controlled page or click a malicious link.

Key dates

06Disclosure timeline

November 22, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-26535 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities

Identifiers

CVE CVE-2023-26535

CWE CWE-352

CVSS 5.4 / MEDIUM

Affected versions