CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through <= 0.3.
Explanation of Vulnerability in Simple Terms
The Affiliate Disclosure Statement plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions 0.3 and earlier. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. This could allow modification of plugin settings or other administrative functions.
What an attacker can do
Perform unwanted administrative actions on the site by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
An attacker could modify plugin settings or perform other admin actions without your consent if you visit a malicious link.
Conditions required to exploit
A site administrator must visit an attacker-controlled webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
