CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
What the vulnerability does
The Visit Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the widgets.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Visit Counter contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in user. The vulnerability requires user interaction—the victim must visit a malicious page while authenticated. An attacker can modify site settings or data, though the impact is limited to low-severity changes.
What an attacker can do
Perform unauthorized actions on the site by tricking a logged-in user into visiting a malicious page.
Potential impact on your site
Site settings or data could be modified without your knowledge if a user clicks a malicious link while logged in.
Conditions required to exploit
Victim must be logged in and visit an attacker-controlled page; no special privileges required.
Key dates
External resources
