CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34.
Explanation of Vulnerability in Simple Terms
The Disable Json API plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated site administrator. An attacker can craft a malicious webpage that, when visited by a logged-in admin, triggers unintended changes to plugin settings or site configuration. The vulnerability affects versions up to 4.34 and requires the admin to visit a malicious link or page.
What an attacker can do
Trick a logged-in admin into changing plugin settings or site configuration without their knowledge.
Potential impact on your site
Plugin settings could be altered by attackers without your consent, potentially disabling security features.
Conditions required to exploit
Admin must visit a malicious webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
