CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Disable Admin Notices individually disable-admin-notices allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through <= 1.4.0.
Explanation of Vulnerability in Simple Terms
The Disable Admin Notices individually plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated site administrator. An attacker can craft a malicious link or page that, when visited by a logged-in admin, triggers unintended changes to plugin settings. No sensitive data is exposed, but site configuration can be altered without the admin's knowledge.
What an attacker can do
Trick a logged-in admin into visiting a malicious page to change plugin settings without their consent.
Potential impact on your site
Plugin settings can be modified without your knowledge if you visit an untrusted link while logged in.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled page or click a malicious link.
Key dates
External resources
Related vulnerabilities
