CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification publish-post-email-notification allows Cross Site Request Forgery.This issue affects publish post email notification: from n/a through <= 1.0.2.3.
Explanation of Vulnerability in Simple Terms
The Publish Post Email Notification plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 1.0.2.3. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the administrator's knowledge or consent. The vulnerability requires user interaction but does not require authentication.
What an attacker can do
Trick a logged-in admin into performing unwanted actions via a malicious webpage.
Potential impact on your site
Attackers can modify site settings or content if an admin visits a malicious link while logged in.
Conditions required to exploit
Admin must visit attacker-controlled webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
