CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The Associados Amazon Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on the brzon_admin_panel() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
The Associados Amazon Plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious webpage that, when visited by an admin, executes unwanted plugin operations without their knowledge. The vulnerability affects all versions up to 0.8 and requires no special privileges to exploit.
What an attacker can do
Perform unauthorized plugin actions on behalf of an admin who visits a malicious webpage.
Potential impact on your site
Attackers can modify plugin settings or trigger plugin functions without your consent if you visit a compromised site.
Conditions required to exploit
An administrator must visit a page controlled by the attacker while logged into WordPress.
Key dates
External resources
Related vulnerabilities
