CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.
Explanation of Vulnerability in Simple Terms
The Mediabay WordPress plugin through version 1.4 is vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions within the plugin without the admin's knowledge or consent. This can lead to unauthorized changes to media library folder settings, data modification, or other administrative functions.
What an attacker can do
Perform unauthorized actions in the plugin by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
An attacker can modify media library folder settings or perform other admin actions without your permission if you visit a malicious link.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special plugin configuration required.
Key dates
External resources
