CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Slava Abakumov BuddyPress Groups Extras buddypress-groups-extras allows Cross Site Request Forgery.This issue affects BuddyPress Groups Extras: from n/a through <= 3.6.10.
Explanation of Vulnerability in Simple Terms
BuddyPress Groups Extras versions 3.6.10 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction—the admin must visit the attacker's page while logged in. This can result in unauthorized modifications or deletion of group data.
What an attacker can do
Trick a logged-in admin into performing unwanted actions on groups, such as modifying or deleting group settings.
Potential impact on your site
Unauthorized changes to BuddyPress groups if admins visit malicious links while logged in. Data integrity at risk.
Conditions required to exploit
Admin must visit attacker-controlled webpage while logged into the site. No special privileges or complex setup required.
Key dates
External resources
Related vulnerabilities
