CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated attackers to delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
The Image Slider by Ays plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 2.7.0. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the slider configuration without the admin's knowledge or consent. The vulnerability requires the admin to visit the attacker's page but does not require the attacker to have any account on the target site.
What an attacker can do
Perform unwanted actions on image slider settings by tricking an admin into visiting a malicious webpage.
Potential impact on your site
An attacker can modify slider configurations, potentially defacing or disrupting image galleries without your knowledge.
Conditions required to exploit
Site admin must be logged in and visit an attacker-controlled webpage; no account required on the target site.
Key dates
External resources
