CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Benjamin Pick Contact Form 7 Select Box Editor Button contact-form-7-select-box-editor-button allows Cross Site Request Forgery.This issue affects Contact Form 7 Select Box Editor Button: from n/a through <= 0.6.
Explanation of Vulnerability in Simple Terms
Contact Form 7 Select Box Editor Button versions 0.6 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in WordPress admin, performs unwanted actions on their behalf without their knowledge. The vulnerability requires the admin to visit the attacker's page while authenticated to WordPress.
What an attacker can do
Perform unwanted actions on a WordPress site when an admin visits a malicious webpage.
Potential impact on your site
An attacker could modify plugin settings or perform other admin actions if an admin visits a malicious link while logged in.
Conditions required to exploit
Admin must be logged into WordPress and visit an attacker-controlled webpage.
Key dates
External resources
Related vulnerabilities
