CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Cross Site Request Forgery.This issue affects HR Management Lite: from n/a through <= 3.6.
Explanation of Vulnerability in Simple Terms
HR Management Lite for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 3.6. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the HR Management plugin without the admin's knowledge or consent. The vulnerability requires the admin to visit the attacker's page while authenticated to the WordPress site.
What an attacker can do
Perform unwanted actions in the HR Management plugin on behalf of a logged-in administrator.
Potential impact on your site
An attacker could modify HR data, settings, or user records by tricking your administrators into visiting a malicious link.
Conditions required to exploit
A logged-in WordPress administrator must visit a page controlled by the attacker.
Key dates
External resources
Related vulnerabilities
