CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through <= 3.1.3.
Explanation of Vulnerability in Simple Terms
Crowdsignal Dashboard contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in user. The vulnerability affects versions up to 3.1.3. An attacker can trick a site administrator or user into visiting a malicious webpage that submits unwanted requests to the plugin. This could result in unauthorized changes to polls, surveys, or plugin settings.
What an attacker can do
Trick a logged-in user into performing unwanted actions like modifying polls or surveys without their knowledge.
Potential impact on your site
An attacker could modify or delete your polls and surveys, or change plugin settings if they trick you into visiting a malicious page.
Conditions required to exploit
The victim must be logged in and visit a page controlled by the attacker (e.g., click a malicious link).
Key dates
External resources
Related vulnerabilities
