CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefy_embed_options_update' settings update action. This makes it possible for unauthenticated attackers to update the plugin's settings, including the API key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Truefy Embed versions 1.1.0 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in user, performs unwanted actions on the user's behalf. The vulnerability requires user interaction—the victim must visit the attacker's page—and affects only the integrity of data, not confidentiality or availability.
What an attacker can do
Perform unwanted actions on behalf of a logged-in user without their knowledge.
Potential impact on your site
Users' accounts can be manipulated to perform unintended actions if they visit malicious sites while logged in.
Conditions required to exploit
Victim must visit an attacker-controlled webpage while logged into a site using Truefy Embed.
Key dates
External resources
