CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Simcast plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the settingsPage function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Simcast versions up to 1.0.0 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unwanted actions on behalf of a user. The vulnerability requires user interaction—the victim must visit a malicious page or click a crafted link while logged in. An attacker can modify data or trigger state-changing operations, but cannot read sensitive information.
What an attacker can do
Perform unwanted actions (modify data, change settings) on behalf of a logged-in user without their knowledge.
Potential impact on your site
Users' accounts can be compromised to perform unintended actions; data integrity may be affected if CSRF targets critical operations.
Conditions required to exploit
User must be logged in and visit an attacker-controlled page or click a malicious link.
Key dates
External resources
