CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Cross Site Request Forgery.This issue affects Most And Least Read Posts Widget: from n/a through <= 2.5.18.
Explanation of Vulnerability in Simple Terms
The Most And Least Read Posts Widget for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 2.5.18. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the widget settings without the admin's knowledge or consent. The vulnerability requires user interaction and does not expose sensitive data.
What an attacker can do
Trick a logged-in admin into modifying widget settings or performing unintended actions via a malicious webpage.
Potential impact on your site
Attackers can alter widget configuration or trigger unintended admin actions if admins visit untrusted sites while logged in.
Conditions required to exploit
Admin must visit attacker's webpage while logged into WordPress. No special privileges or authentication required from attacker.
Key dates
External resources
Related vulnerabilities
