CVE-2023-41654 MEDIUM

CVE-2023-41654: WordPress authLdap Plugin <= 2.5.8 is vulnerable to Cross Site Request Forgery (CSRF)

Vendor Andreas Heigl

Product authLdap

Weakness CWE-352 · CSRF

Published October 6, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Andreas Heigl authLdap plugin <= 2.5.8 versions.

Explanation of Vulnerability in Simple Terms

02Summary

authLdap versions up to 2.5.8 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious link or webpage that, when visited by an authenticated user, performs unwanted actions on the authLdap installation without the user's knowledge. The vulnerability requires user interaction and does not expose sensitive data, but can modify site configuration or settings.

What an attacker can do

03Attacker Capabilities

Trick an authenticated user into performing unwanted actions on the authLdap installation via a malicious link or webpage.

Potential impact on your site

04Site Impact

Site configuration or settings could be altered without authorization if an admin visits a malicious link while logged in.

Conditions required to exploit

05Prerequisites

An authenticated user must visit a malicious webpage or click a crafted link while logged into authLdap.

Key dates

06Disclosure timeline

October 6, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-41654 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities